JP3775175B2 - Key processing method and disk manufacturer side processing apparatus - Google Patents

Description

なお、上記手順の２行目は、Ｍ_kiを用いてＥ_Mki （Ｓ_K ）を復号し、これをＤＳ１［ｉ］に代入する操作を示す。
【０１２２】
上記手順の３行目は、Ｓ_kiを用いてＥ_Sk（Ｓ_K ）を復号し、これをＤＳ２［ｉ］に代入する操作を示す。
【０１２３】
上記手順の４行目は、ＤＳ１［ｉ］とＤＳ２［ｉ］が一致するかどうを判断する操作を示す。
【０１２４】
上記手順の９行目は、ＤＳ１［ｉ］とＤＳ２［ｉ］が不一致の場合の操作を示す。
【０１２５】
さて、例えば図６の鍵判定回路１２０では、復号化回路１１２により、まず、ｊ＝１として、Ｅ_Mki （Ｓ_K ）を、マスターキーＭ_kjで復号して、
Ｓ_kij ＝Ｄ_Mkj （Ｅ_Mki （Ｓ_K ））
を得る。
【０１２６】
次に、復号化回路１１２により、Ｅ_Sk（Ｓ_K ）をＳ_kij で復号して、
Ｓ_k ′′＝Ｄ_Skij（Ｅ_Sk（Ｓ_K ））
を得る。
【０１２７】
次に、比較回路１２１により、上記のＳ_k ′′と＝Ｓ_kij を比較し、一致した場合、ゲート回路１２２を制御して、保持しておいたＳ_kij （図６（ａ））またはＳ_k ′′（図６（ｂ））を、第１のセッションキーＳ_K として出力する。
【０１２８】
一致しなかった場合、上記のｊを１ずつ増加させながら、同様の動作を、第１のセッションキーＳ_K が得られるまで繰り返す。
【０１２９】
以上のようにして第１のセッションキーＳ_K を得た後、ステップＳ２０で、図示しないＤＶＤ駆動装置によりＤＶＤ１０１に記録されている、第１のセッションキーＳ_K を用いて暗号化された画像データＥ_SK（Ｄａｔａ）を読み出し、暗号ユニット１０７内に取り込む。その際、復調／誤り訂正回路１１８により復調、データ中の誤り訂正が行われる。そして、Ｅ_SK（Ｄａｔａ）を、ＣＰＵ ＢＵＳ１１０を通じて暗号化ユニット１０７に送る。
【０１３０】
次に、ステップＳ２１で、復号化ユニット１１４ａでは、復号化回路１１２において、ＣＰＵ ＢＵＳ１１０を通じて受け取ったＥ_SK（Ｄａｔａ）を、第１のセッションキーＳ_K を用いて復号し、
Ｄ_SK（Ｅ_SK（Ｄａｔａ））＝Ｄａｔａ
となり、暗号化された画像データを復号して、平文のＤａｔａを得ることができる。
【０１３１】
そして、例えば復号すべきデータ（すなわちＥ_SK（Ｄａｔａ））が終了し、あるいは処理の中止を要求されるまで、上記のステップＳ２０とステップＳ２１が繰り返し行われる。
【０１３２】
以上のようにして得られた画像データＤａｔａは、例えばＭＰＥＧ２というデータ圧縮規格に従って圧縮されている場合にはＭＰＥＧデコーダ回路１１５でデコードされ、そしてＤ／Ａ変換回路１１６でアナログ信号に変換された後、図示しないテレビなどの映像装置に送られ、再生される。
【０１３３】
なお、上記のステップＳ１１と、ステップＳ１２と、ステップＳ１３およびＳ１４とは、いずれを先に実行しても構わない。
【０１３４】
また、上記のステップＳ１５およびステップＳ１７と、ステップＳ１６およびＳ１８とは、いずれを先に実行しても構わない。
【０１３５】
また、ステップＳ２０とステップＳ２１の実行については、１つのＥ_SK（Ｄａｔａ）の単位で逐次行う方法、あるいはステップＳ２０で所定数のＥ_SK（Ｄａｔａ）を読み込み、一旦バッファなどへ格納し、次にステップＳ２１でバッファ内のＥ_SK（Ｄａｔａ）を復号する方法、あるいはステップＳ２０とステップＳ２１をパイプライン処理的に行う方法などが考えられる。
【０１３６】
また、復号化回路１１２からＭＰＥＧデコーダ回路１１５に画像データＥ_SK （Ｄａｔａ）を渡す際に、１つのＤａｔａの単位で渡しても良いし、所定数のＤａｔａの単位で渡しても良い。
【０１３７】
以上のように本実施形態によれば、第１の実施形態と同様に、ＣＰＵ ＢＵＳを流れるデータを保存したとしても、それを再生または利用することはできない。
【０１３８】
この結果、不正なコピーにより、メディアを販売する不法な行為を防止し、著作権を守ることができる。
【０１３９】
また、本実施形態によれば、記録媒体に記録した第１のセッションキーを暗号化するのに用いたマスターキーを直接示す情報が不要であり、ＤＶＤなどへの記録の際に予め定められた範囲内で適宜マスターキーを選択して使用することが可能となる。あるいは、ＤＶＤの制作・販売会社などの所定の単位ごとに使用可能なマスターキーを割り当てることができるなどの利点がある。
【０１４０】
もちろん、本実施形態でも、暗号化および復号化に用いる回路は、ＤＶＤなどのディジタル記録再生機器の再生部分のコアとなる個所とは別に設計できるため、たとえ暗号が破られたとしても、復号化ユニット１１４ａ（あるいは暗号化ユニット１０７および復号化ユニット１１４ａ）を交換するだけで良い。
【０１４１】
なお、本実施形態では、暗号化ユニット１０７は１つの暗号化回路を持つものとしたが、２つの暗号化回路を設けても良い。また、復号化ユニット１１４ａは１つの復号化回路を持つものとしたが、２、３、４、または５つの復号化回路を設けても良い。これらの場合、対応する暗号化回路と復号化回路をセットで独立化するのが好ましい。
【０１４２】
また、対応する暗号化回路と復号化回路をセットで独立化する場合、独立化した対応する暗号化回路と復号化回路では、他の暗号化回路および復号化回路とは異なる暗号方式を採用しても構わない。
【０１４３】
次に、前述した（方法２）のように、ＤＶＤ１０１にはｉ＝１〜ｎのすべてに対応するｎ個のＥ_MKi （Ｓ_K ）を記録し、復号化ユニット１１４ａ内にはｊを１〜ｎのいずれかとする１つのＭ_kjを備える場合について図７および図８のフローチャートを参照しながら本実施形態の動作を説明する。
【０１４４】
ステップＳ１１で、図示しないＤＶＤ駆動装置によりＤＶＤ１０１に記録されている、第１のセッションキーＳ_K 自身で暗号化された第１のセッションキーＥ_Sk（Ｓ_K ）を読み出し、暗号ユニット１０７内に取り込む。その際、復調／誤り訂正回路１１７により復調、データ中の誤り訂正が行われる。
【０１４５】
また、ステップＳ１２で、図示しないＤＶＤ駆動装置によりＤＶＤ１０１に記録されている、マスターキーＭ_kiを用いて暗号化されたｎ個の第１のセッションキーＥ_Mki （Ｓ_K ）（ｉ＝１〜ｎ）を読み出し、暗号ユニット１０７内に取り込む。その際、復調／誤り訂正回路１１７により復調、データ中の誤り訂正が行われる。
【０１４６】
一方、ステップＳ１３で、復号化ユニット１１４ａでは、セッションキー生成回路１１１において、乱数、例えば時計（図示せず）からの時間情報を入力として第２のセッションキーＳ_K ′を生成する。そして、復号化回路１１２において、生成された第２のセッションキーＳ_K ′を、マスターキーＭ_kj（ここでｊは１〜ｎのうち予め定められたもの）を用いて復号してＤ_Mkj （Ｓ_K ′）を生成し、ＣＰＵ ＢＵＳ１１０を通じて暗号化ユニット１０７に送る。
【０１４７】
上記の乱数を発生するタイミング（例えば時間情報を入力するタイミング）としては、例えば、ＤＶＤ駆動装置にＤＶＤ１０１が装着されたことを示す信号がアサートされたタイミングを用いることができる。
【０１４８】
ステップＳ１４で、暗号ユニット１０７では、暗号化回路１０４において、ＣＰＵ ＢＵＳ１１０を通じて受け取ったＤ_Mkj （Ｓ_K ′）を、マスターキーをマスターキーＭ_kj（ここでｊは１〜ｎのうち予め定められたもの）を用いて暗号化する。すなわち、
Ｅ_Mkj （Ｄ_Mkj （Ｓ_K ′））＝Ｓ_K ′
により、復号化ユニット１１４ａ内のセッションキー生成回路１１１で生成された第２のセッションキーＳ_K ′を得ることができる。
【０１４９】
ここで、セッションキー生成回路１１１で生成された第２のセッションキーＳ_K ′は、ＣＰＵ ＢＵＳ１１０上で盗まれたとしても解らないようにしてある。
【０１５０】
次に、ステップＳ１５で、暗号ユニット１０７では、上記のようにして得られた第２のセッションキーＳ_K ′を用いて、ＤＶＤ１０１に記録された暗号化された第１のセッションキーＥ_Sk（Ｓ_K ）を暗号化して、Ｅ_{SK ′}（Ｅ_Sk（Ｓ_K ））を生成し、これをＣＰＵ ＢＵＳ１１０を通じて復号化ユニット１１４ａへ送る。
【０１５１】
同様に、ステップＳ１６で、暗号ユニット１０７では、上記のようにして得られた第２のセッションキーＳ_K ′を用いて、ＤＶＤ１０１に記録された暗号化されたｎ個の第１のセッションキーＥ_Mki （Ｓ_K ）を夫々暗号化して、Ｅ_{SK ′}（Ｅ_Mki （Ｓ_K ））を生成し、これをＣＰＵ ＢＵＳ１１０を通じて復号化ユニット１１４ａへ送る。
【０１５２】
次に、ステップＳ１７で、復号化ユニット１１４ａでは、復号化回路１１２において、ＣＰＵ ＢＵＳ１１０を通じて受け取ったＥ_{SK ′}（Ｅ_Sk（Ｓ_K ））を、第２のセッションキーＳ_K ′を用いて復号し、
Ｄ_{SK ′}（Ｅ_{SK ′}（Ｅ_Sk（Ｓ_K ）））＝Ｅ_Sk（Ｓ_K ）
を得る。
【０１５３】
同様に、ステップＳ１８で、復号化ユニット１１４ａでは、復号化回路１１２において、ＣＰＵ ＢＵＳ１１０を通じて受け取ったｎ個のＥ_{SK ′}（Ｅ_Mki （Ｓ_K ））を、第２のセッションキーＳ_K ′を用いて夫々復号し、
Ｄ_{SK ′}（Ｅ_{SK ′}（Ｅ_Mki （Ｓ_K ）））＝Ｅ_Mki （Ｓ_K ）
を得る。
【０１５４】
ここで、ＤＶＤ１０１に記録されているｎ個のＥ_Mki （Ｓ_K ）（ｉ＝１〜ｎ）の各々について、それを生成する際に用いられたマスターキーＭ_kiは未知であり、復号化ユニット１１４ａ内に備えられたマスターキーＭ_kjに対応するものがどれなのかは、分からないようになっている。そこで、ステップＳ１９において、以下に示すように鍵判定回路１２０を用いて第１のセッションキーＳ_K を求める。
【０１５５】
最初に、鍵判定処理の原理について説明する。
【０１５６】
まず、マスターキーＭ_kjで、すべてのＥ_Mki （Ｓ_K ）（ｉ＝１〜ｎ）を夫々復号すると、
Ｓ_kij ＝Ｄ_Mkj （Ｅ_Mki （Ｓ_K ））（ｉ＝１〜ｎ）
が得られる。ここで、Ｓ_kij （ｉ＝１〜ｎ）のうちのいずれかが第１のセッションキーＳ_K である。
【０１５７】
次に、上記のＥ_Sk（Ｓ_K ）を用いて、生成されたＳ_kij （ｉ＝１〜ｎ）のいずれが第１のセッションキーＳ_K であるかを調べる。
【０１５８】
そこで、Ｅ_Sk（Ｓ_K ）を、すべての第１のセッションキーの候補Ｓ_kij （ｉ＝１〜ｎ）で夫々復号すると、
Ｓ_k ′′（ｉ，ｊ）＝Ｄ_Skij（Ｅ_Sk（Ｓ_K ））
が得られる。
【０１５９】
ここで、Ｅ_Mki （Ｓ_K ）を生成する際に用いられたマスターキーＭ_kiと同一のマスターキーＭ_kjを復号化ユニット内で用いた場合に、すなわち、ｉ＝ｊの場合に、Ｓ_k ′′（ｉ，ｊ）＝Ｓ_kij ＝Ｓ_K となる。
【０１６０】
したがって、各Ｓ_kij （ｉ＝１〜ｎ）について、Ｓ_k ′′（ｉ，ｊ）＝Ｓ_kij （ｊ＝１〜ｎ）が成立するか否かを調べることにより、Ｓ_k ′′（ｉ，ｊ）＝Ｓ_kij （ｊ＝１〜ｎ）を満足するＳ_kij を、第１のセッションキーＳ_K として得ることができる。なお、このＳ_kij を与えるｉに対応するものが今回使用されたマスターキーである。
【０１６１】
さて、例えば図６の鍵判定回路１２０では、復号化回路１１２により、まず、ｉ＝１として、Ｅ_Mki （Ｓ_K ）を、マスターキーＭ_kjで復号して、
Ｓ_kij ＝Ｄ_Mkj （Ｅ_Mki （Ｓ_K ））
を得る。
【０１６２】
次に、復号化回路１１２により、Ｅ_Sk（Ｓ_K ）をＳ_kij で復号して、
Ｓ_k ′′＝Ｄ_Skij（Ｅ_Sk（Ｓ_K ））
を得る。
【０１６３】
次に、比較回路１２１により、上記のＳ_k ′′と＝Ｓ_kij を比較し、一致した場合、ゲート回路１２２を制御して、保持しておいたＳ_kij （図６（ａ））またはＳ_k ′′（図６（ｂ））を、第１のセッションキーＳ_K として出力する。
【０１６４】
一致しなかった場合、上記のｉを１ずつ増加させながら、同様の動作を、第１のセッションキーＳ_K が得られるまで繰り返す。
【０１６５】
以上のようにして第１のセッションキーＳ_K を得た後、前述したようにステップＳ２０〜Ｓ２２で、第１のセッションキーＳ_K を使って、暗号化された画像データＥ_SK（Ｄａｔａ）から画像データＤａｔａを取り出す。
【０１６６】
そして、前述したように、画像データＤａｔａは、ＭＰＥＧデコーダ回路１１５でデコードされ、Ｄ／Ａ変換回路１１６でアナログ信号に変換されるなどして、図示しないテレビなどの映像装置に送られ、再生される。
【０１６７】
なお、この方法２の場合においても、上記のステップＳ１１と、ステップＳ１２と、ステップＳ１３およびＳ１４とは、いずれを先に実行しても構わない。
【０１６８】
また、上記のステップＳ１５およびステップＳ１７と、ステップＳ１６およびＳ１８とは、いずれを先に実行しても構わない。
【０１６９】
さらに、ステップＳ１２，Ｓ１６，Ｓ１８、Ｓ１９を、ＤＶＤに記録されたｎ個の（暗号化された）マスターキーを一括してバッチ的に行っても良いが、所定数個のマスターキーごとにバッチ的に行っても良いし、１つのマスターキーごとに逐次行っても良い。
【０１７０】
また、３番目の１つのマスターキーごとに逐次行う場合、第２のセッションキーＳ_K ′を、マスターキーごとに生成しても良い。
【０１７１】
また、ステップＳ２０とステップＳ２１の実行については、１つのＥ_SK（Ｄａｔａ）の単位で逐次行う方法、あるいはステップＳ２０で所定数のＥ_SK（Ｄａｔａ）を読み込み、一旦バッファなどへ格納し、次にステップＳ２１でバッファ内のＥ_SK（Ｄａｔａ）を復号する方法、あるいはステップＳ２０とステップＳ２１をパイプライン処理的に行う方法などが考えられる。
【０１７２】
また、復号化ユニット１１４からＭＰＥＧデコーダ回路１１５に画像データＥ_SK（Ｄａｔａ）を渡す際に、１つのＤａｔａの単位で渡しても良いし、所定数のＤａｔａの単位で渡しても良い。
【０１７３】
以上のように本実施形態によれば、第１の実施形態と同様に、ＣＰＵ ＢＵＳを流れるデータを保存したとしても、それを再生または利用することはできない。
【０１７４】
この結果、不正なコピーにより、メディアを販売する不法な行為を防止し、著作権を守ることができる。
【０１７５】
また、本実施形態によれば、記録媒体に複数のマスターキーを夫々用いて暗号化した第１のセッションキーと、第１のセッションキー自身で暗号化した第１のセッションキーとを格納するので、復号化ユニット内に作り込むマスターキーを、所定の単位、例えばユニットの製造メーカーごとに割り当てて使用することができるなどの利点がある。
【０１７６】
また、本実施形態でも、暗号化および復号化に用いる回路は、図１から解るようにＤＶＤなどのディジタル記録再生機器の再生部分のコアとなる個所とは別に設計できるため、たとえ暗号が破られたとしても、復号化ユニット１１４ｂ（あるいは暗号化ユニット１０７および復号化ユニット１１４ｂ）を交換するだけで良い。
【０１７７】
なお、本実施形態では、暗号ユニット１０７は１つの暗号化回路を持つものとしたが、２つの暗号化回路を設けても良い。また、復号化ユニット１１４ａは１つの復号化回路を持つものとしたが、２、３、４、または５つの復号化回路として設けても良い。これらの場合、対応する暗号化回路と復号化回路をセットで独立化しあるいは共用するのが好ましい。
【０１７８】
また、対応する暗号化回路と復号化回路をセットで独立化する場合、独立化した対応する暗号化回路と復号化回路では、他の暗号化回路および復号化回路とは異なる暗号方式を採用しても構わない。
【０１７９】
次に、前述した（方法３）のように、ＤＶＤ１０１にはｉ＝１〜ｎのすべてに対応するｎ個のＥ_MKi （Ｓ_K ）を記録し、復号化ユニット１１４ａ内にはｊを１〜ｎのうちのｍ（＜ｎ）種類のものとするｍ個のＭ_kjを備える場合について説明する。
【０１８０】
この方法３は、基本的な構成・動作・効果は上記の方法２と同様であるので、ここでは、相違点のみを説明する。
【０１８１】
上記の方法２では、復号ユニット１１４ａ内に予め定めた１個のマスターキーＭ_kj（ｊ＝１〜ｎのいずれか１つ）を備えたが、この方法３では、復号ユニット１１４ａ内に予め定めたｍ（≧２）個のマスターキーＭ_kjを備えておく。そして、ｍ個のマスターキーＭ_kj（ｊ＝１〜ｎのいずれかｍ個）について、復号化ユニット１１４ｂ内で前述した鍵判定に使用する順位を決めておく。
【０１８２】
最初は、ＤＶＤ１０１にはｉ＝１〜ｎのすべてに対応するｎ個のＥ_MKi （Ｓ_K ）を記録しているので、復号化ユニット１１４ｂ内で使用順位が１位のマスターキーを用いれば、第１のセッションキーＳ_K を得ることができるので、この場合には、前述の方法２と同様の動作になる。
【０１８３】
次に、方法３では、いずれかのマスターキーが破られるなどした場合、そのマスターキーを使用不可とし、以降、ＤＶＤ１０１には使用不可となったマスターキーに対応するＥ_MKi （Ｓ_K ）を記録しないようにした場合を考える。
【０１８４】
ここで、使用不可となったマスターキーが、使用順位が１位のマスターキーでない場合、第１のセッションキーＳ_K を得ることができるので、この場合にも、前述の方法２と同様の動作になる。
【０１８５】
一方、使用順位が１位のマスターキーが使用不可となった場合、ＤＶＤ１０１に該マスターキーに対応するＥ_MKi （Ｓ_K ）は記録されていないので、この使用順位が１位のマスターキーを使っても、前述のステップＳ１９にて第１のセッションキーＳ_K を得ることはできない。このような場合に、復号ユニット１１４ａ内で、使用順位が２位のマスターキーを用いて方法２と同様の動作を行うことにより、このマスターキーが使用不可となっていない場合、第１のセッションキーＳ_K を得ることができる。
【０１８６】
以下、使用順位がｒ位のマスターキーが使用不可となっても、使用順位がｒ＋１位以降のマスターキーで使用不可となっていないものがある場合、同様にして第１のセッションキーＳ_K を得ることができる。
【０１８７】
このようにして、復号化ユニット１１４ａ内に予め定めたｍ（≧２）個のマスターキーが全て使用不可となるまで、本復号化ユニット１１４ａを使用することができる。
【０１８８】
なお、前述した（方法５）の動作は、上記（方法３）と同様になる。
【０１８９】
また、前述した（方法４）は、ＤＶＤ１０１には全てのマスターキーに対応する情報が格納されていないので、復号化ユニット内で選択したマスターキーに対応する情報がＤＶＤ１０１に記録されていない場合には、上記の使用不可の場合と同様に復号できないことになり、次の使用順位のマスターキーを選択して復号を試行することになる。従って、この（方法４）の動作も、上記（方法３）と同様になる。
【０１９０】
ところで、本実施形態において、ＣＰＵ ＢＵＳ１１０上を情報を暗号化して安全に転送するために、第２のセッションキーＳ_K ′を用いた。この第２のセッションキーＳ_K ′は、復号化ユニット１１４ａ内で生成され、マスターキーを用いた手順により暗号化ユニット１０７に伝えられた。その際、本実施形態では、暗号化ユニット１０７内には、予め定められた１つのマスターキーが登録されているものとした。
【０１９１】
その代わりに、暗号化ユニット１０７内にも複数のマスター鍵を登録しておき、鍵判定を用いる前述した（方法１）〜（方法５）のような手順を用いて、第２のセッションキーＳ_K ′を復号化ユニット１１４ａから暗号化ユニット１０７に伝えるようにしてもよい。
【０１９２】
例えば、復号化ユニット１１４ａ内に登録されているマスターキーと同一のものを暗号化ユニット１０７にも登録する場合、上記の（方法５）になる。
【０１９３】
また、復号化ユニット１１４ａ内に登録されているマスターキーの一部の複数のものを暗号化ユニット１０７に登録する場合、上記の（方法３）になる。
【０１９４】
なお、暗号化ユニット１０７に１つのマスターキーを登録する場合にも、上記の（方法２）の手順を用いることができる。
【０１９５】
ただし、これらの場合、（方法１）〜（方法５）の手順において、暗号化と復号とを入れ替えた手順となる。すなわち、復号化ユニット１１４ａから暗号化ユニット１０７にＤ_MKi （Ｓ_K ）とＤ_SK（Ｓ_K ）とを転送することになる。
【０１９６】
なお、第２のセッションキーＳ_K ′をＣＰＵ ＢＵＳ１１０上を介して復号化ユニット１１４ａから暗号化ユニット１０７に安全に伝えるための構成としは、上記のマスターキーを用いる構成の他にも、種々のものが適用可能である。例えば、「日経エレクトロニクス Ｎｏ．６７６ ｐｐ．１３−１４ １９９６．１１．１８」に開示された技術を応用することもできる。この場合、暗号化ユニット１０７内へのマスターキーの登録は不要である。
【０１９７】
（第３の実施形態）
次に、第３の実施形態について説明する。
【０１９８】
本実施形態は、例えば単体のＤＶＤプレーヤーである。
【０１９９】
図９は、本発明の第２の実施形態に係るシステムの構成を示すブロック図である。また、本実施形態の動作の一例を図１０のフローチャートに示す。
【０２００】
本実施形態は、第２の実施形態の構成から、暗号化ユニットと復号ユニットとの間で第２のセッションキーを用いて暗号化鍵を受け渡しする動作に関する部分を削除したものである。
【０２０１】
すなわち、図９に示すように、本実施形態に係るシステムは、ＤＶＤ１０１からデータの読み出すＤＶＤ駆動装置（図示せず）、復号化ユニット１１４ｂを備えている。
【０２０２】
復号化ユニット１１４ｂは、復号化回路１１２、鍵判定回路１２０、復調／誤り訂正回路１１７、復調／誤り訂正回路１１８を備えている。また、本実施形態では、復号化ユニット１１４内にＭＰＥＧのデコーダ回路１１５および復号された画像データをディジタルからアナログに変換する変換回路１１６を備えているものとする。
【０２０３】
ここで、鍵判定回路１２０は、図６の一構成例に示すように、復号化回路１１２、比較回路１２１、ゲート回路１２２を備えている。
【０２０４】
図９および図６中で、復号化ユニット１１４ｂ内には、鍵判定回路１２０内の２つの復号化回路１１２を含めて、全部で３つの復号化回路１１２を示しているが、実際には１つの復号化回路であるものとする。なお、復調／誤り訂正回路１１７および復調／誤り訂正回路１１８は、暗号化ユニット１０７内には備えず、その前段のユニット等の側に備えられる場合もある。
【０２０５】
復号化ユニット１１４ｂは、独立した１つのＩＣチップとして形成されるものとする。
【０２０６】
また、復号化ユニット１１４ｂ内には、後述するマスターキーが登録されている（作り込まれている）。マスターキーは、利用者が外部から取得できないように、復号化ユニットのチップにおいて、利用者が意図的に取り出せないようにチップ内部の秘匿された領域に記録されているものとする。
【０２０７】
本実施形態では、第１のセッションキーをＳ_K 、第２のセッションキーをＳ_K ′、ｎ種類存在するマスターキーのうちのｉ番目のものをＭ_ki（ここでｉ＝１〜ｎ）、画像データ（ただし、暗号化された一纏まりのデータ）をＤａｔａで表す。これらはいずれも平文である。
【０２０８】
図１中、１０２−１は第１のセッションキーＳ_K をマスターキーＭ_kiを用いて暗号化して生成されたＥ_MKi （Ｓ_K ）を、１０２−２は第１のセッションキーＳ_K を第１のセッションキーＳ_K 自身で暗号化して生成されたＥ_Sk（Ｓ_K ）を、１０３は画像データＤａｔａを第１のセッションキーＳ_K を用いて暗号化して生成されたＥ_SK（Ｄａｔａ）を、１０５はマスターキーＭ_kjを、１１３は第１のセッションキーＳ_K をそれぞれ表す。
【０２０９】
ここで、前述の第２の実施形態と同様に、ＤＶＤ１０１に記録する第１のセッションキーＳ_K をマスターキーＭ_kiを用いて暗号化して生成されたＥ_MKi （Ｓ_K ）の種類数と、復号化ユニット１１４ｂ内に持つマスターキーＭ_kjの種類数の設定について、例えば次に示すように幾つかの方法が考えられる。
【０２１０】
（方法１）ＤＶＤ１０１にはｉを１〜ｎのいずれかとする１つのＥ_MKi （Ｓ_K ）を記録し、復号化ユニット１１４ｂ内にはｊ＝１〜ｎのすべてに対応するｎ個のＭ_kjを備える。
【０２１１】
（方法２）ＤＶＤ１０１にはｉ＝１〜ｎのすべてに対応するｎ個のＥ_MKi （Ｓ_K ）を記録し、復号化ユニット１１４ｂ内にはｊを１〜ｎのいずれかとする１つのＭ_kjを備える。
【０２１２】
（方法３）ＤＶＤ１０１にはｉ＝１〜ｎのすべてに対応するｎ個のＥ_MKi （Ｓ_K ）を記録し、復号化ユニット１１４ｂ内にはｊを１〜ｎのうちのｍ（２＜ｍ＜ｎ）種類のものとするｍ個のＭ_kjを備える。
【０２１３】
（方法４）ＤＶＤ１０１にはｉを１〜ｎのうちのから予め選択されたｍ（２＜ｍ＜ｎ）種類のものとするｍ個のマスターキーＥ_MKi （Ｓ_K ）を記録し、復号化ユニット１１４ｂ内にはｊ＝１〜ｎのすべてに対応するｎ個のマスターキーＭ_kjを備える。
【０２１４】
（方法５）ＤＶＤ１０１にはｉ＝１〜ｎのすべてに対応するｎ個のマスターキーＥ_MKi （Ｓ_K ）を記録し、復号化ユニット１１４ｂ内にはｊ＝１〜ｎのすべてに対応するｎ個のマスターキーＭ_kjを備える。
【０２１５】
図３に示すように、ＤＶＤ１０１上で、第１のセッションキーＳ_K をマスターキーＭ_kiを用いて暗号化して生成された１個（上記の（方法１）の場合）または複数個（上記の（方法２）〜（方法５）の場合）のＥ_MKi （Ｓ_K ）は、最内周部分の鍵記録領域（リードインエリア）に、画像データＤａｔａを第１のセッションキーＳ_K を用いて暗号化して生成されたＥ_SK（Ｄａｔａ）は、データ記録領域（データエリア）に記録されているものとする。
【０２１６】
次に、図１０のフローチャートを参照しながら本実施形態の動作について説明する。なお、本実施形態の動作は、第２の実施形態の動作から、暗号化ユニットと復号ユニットとの間で第２のセッションキーを用いて暗号化鍵を受け渡しする動作に関する部分を削除したものである。
【０２１７】
すなわち、ステップＳ３１で、図示しないＤＶＤ駆動装置によりＤＶＤ１０１に記録されている、第１のセッションキーＳ_K 自身で暗号化された第１のセッションキーＥ_Sk（Ｓ_K ）を読み出し、復号化ユニット１１４ｂ内に取り込む。その際、復調／誤り訂正回路１１７により復調、データ中の誤り訂正が行われる。
【０２１８】
また、ステップＳ３２で、図示しないＤＶＤ駆動装置によりＤＶＤ１０１に記録されている、マスターキーＭ_kiを用いて暗号化された第１のセッションキーＥ_Mki （Ｓ_K ）を読み出し、復号化ユニット１１４ｂ内に取り込む。その際、復調／誤り訂正回路１１７により復調、データ中の誤り訂正が行われる。
【０２１９】
次に、ステップＳ３３において、鍵判定回路１２０を用いて第１のセッションキーＳ_K を求める。
【０２２０】
以上の第１のセッションキーＳ_K を求める動作は、（方法１）、（方法２）、（方法３〜方法５）により相違するが、いずれの場合についても既に第２の実施形態において説明したものと同様であるので、ここでの説明は省略する。
【０２２１】
第１のセッションキーＳ_K を得た後は、前述したようにステップＳ３４〜Ｓ３６で、第１のセッションキーＳ_K を使って、暗号化された画像データＥ_SK（Ｄａｔａ）から画像データＤａｔａを取り出す。なお、ステップＳ３４〜Ｓ３６の動作は、ユニット間でＣＰＵ ＢＵＳを介した画像データＤａｔａの受け渡しがない以外は、第２の実施形態において既に説明したステップＳ２０〜Ｓ２２（すなわち、第１の実施形態において既に説明したステップＳ６〜Ｓ８）と同様である。
【０２２２】
そして、前述したように、画像データＤａｔａは、ＭＰＥＧデコーダ回路１１５でデコードされ、Ｄ／Ａ変換回路１１６でアナログ信号に変換されるなどして、図示しないテレビなどの映像装置に送られ、再生される。
【０２２３】
なお、この方法３の場合においても、上記のステップＳ３１と、ステップＳ３２とは、いずれを先に実行しても構わない。
【０２２４】
また、（方法２）および（方法３〜５）の場合において、ステップＳ３２、Ｓ３３を、ＤＶＤに記録されたｎ個（方法２，３，５の場合）あるいはｍ個（方法４の場合）の（暗号化された）マスターキーを一括してバッチ的に行っても良いが、所定数個のマスターキーごとにバッチ的に行っても良いし、１つのマスターキーごとに逐次行っても良い。
【０２２５】
また、ステップＳ３４とステップＳ３５の実行については、１つのＥ_SK（Ｄａｔａ）の単位で逐次行う方法、あるいはステップＳ２０で所定数のＥ_SK（Ｄａｔａ）を読み込み、一旦バッファなどへ格納し、次にステップＳ２１でバッファ内のＥ_SK（Ｄａｔａ）を復号する方法、あるいはステップＳ２０とステップＳ２１をパイプライン処理的に行う方法などが考えられる。
【０２２６】
また、復号化ユニット１１４からＭＰＥＧデコーダ回路１１５に画像データＥ_SK（Ｄａｔａ）を渡す際に、１つのＤａｔａの単位で渡しても良いし、所定数のＤａｔａの単位で渡しても良い。
【０２２７】
本実施形態によれば、不正なコピーにより、メディアを販売する不法な行為を防止し、著作権を守ることができる。
【０２２８】
また、本実施形態によれば、ＤＶＤなどへの記録の際に予め定められた範囲内で適宜マスターキーを選択して使用することが可能となる。あるいは、ＤＶＤプレーヤーのメーカまたはＤＶＤの制作・販売会社などの所定の単位ごとに使用可能なマスターキーを割り当てて使用することができるなどの利点がある。
【０２２９】
また、本実施形態では、暗号化および復号化に用いる回路は、図１から解るようにＤＶＤなどのディジタル記録再生機器の再生部分のコアとなる個所とは別に設計できるため、たとえ暗号が破られたとしても、復号化ユニット１１４ｂを交換するだけで良い。
【０２３０】
なお、本実施形態では、復号化ユニット１１４ｂは１つの復号化回路を持つものとしたが、２または３つの復号化回路として設けても良い。これらの場合、対応する暗号化回路と復号化回路をセットで独立化しあるいは共用するのが好ましい。
【０２３１】
また、対応する暗号化回路と復号化回路をセットで独立化する場合、独立化した対応する暗号化回路および復号化回路では、他の暗号化回路および復号化回路とは異なる暗号方式を採用しても構わない。
【０２３２】
以上、第１の実施形態、第２の実施形態（より詳しくは３種類の構成）、第３の実施形態（より詳しくは３種類の構成）について夫々説明してきたが、本発明はこれらに限定されず種々変形して実施することができる。
【０２３３】
各実施形態では、情報の記録媒体をＤＶＤとして説明したが、本発明は、ＣＤ−ＲＯＭ等他の記録媒体にも適用可能である。
【０２３４】
各実施形態では、復号対象となる情報として画像データを例にとって説明したが、本発明は、音声、テキスト、プログラムなど、他の形態の情報の再生装置等にも適用可能である。
【０２３５】
なお、各実施形態では、データＤａｔａを画像データとしたが、データＤａｔａを鍵情報Ｓ_ktとする構成も考えられる。すなわち、ＤＶＤ等の記録媒体に、Ｅ_SK（Ｄａｔａ）の代わりに、Ｅ_SK（Ｓ_kt）とＥ_Skt （Ｄａｔａ）を記録しておき、復号化ユニット１１４，１１４ａ，１１４ｂにおいて各実施形態で示した手順により、まずＳ_ktを得て、このＳ_ktでＥ_Skt （Ｄａｔａ）を復号して実際のコンテンツを得るようにすることもできる。また、このような鍵の階層化は、任意の階層に渡って行うことができる。
【０２３６】
各実施形態では、復号対象となる情報がＭＰＥＧ２という規格に従って圧縮されている場合を例にとって説明したが、本発明はこれに限定されず、他の規格によってデータ圧縮あるいは符号化等されていても構わない。この場合、ＭＰＥＧデコーダ回路１１５の代わりに、他の対応するデコーダ回路を設ける。また、符号化等されていないものであっても構わない。この場合、ＭＰＥＧデコーダ回路１１５を削除する。
【０２３７】
また、種々の方式で圧縮等されたデータ（あるいは復号の必要ないデータ）のいずれも出力できるように、複数種類のデコード回路等を設け、これを適宜切替て使用し（あるいはこれらを使用しないように）構成することも可能である。この場合、例えば、ＤＶＤ等の記録媒体から使用すべきデコード等を示す識別子を読み込む、この識別子に従って適切なデコード回路等を選択等する方法が考えられる。
【０２３８】
第２の実施形態および第３の実施形態にて示した図６の鍵判定回路１２０の構成は一例であり、この他にも種々の構成が考えられる。
【０２３９】
さらに、鍵判定用情報としてＥ_SK（Ｓ_K ）を用いる構成は、この他にも種々のものが考えられる。例えば、鍵判定に用いる情報としてＤ_SK（Ｓ_K ）を用い、鍵判定回路１２０では、ＤＶＤ等の記録媒体から読み込んだＥ_Mki （Ｓ_K ）を記憶されたマスターキーＭ_kjで復号してＳ_kij ＝Ｄ_Mkj （Ｅ_Mki （Ｓ_K ））を得て、このＳ_kij をＳ_kij 自身で復号してＳ_k ′′′＝Ｄ_Skij（Ｓ_kij ）を得て、次に、このＳ_k ′′とＤＶＤ等の記録媒体から読み込んだＤ_SK（Ｓ_K ）を比較し、一致した場合、第１のセッションキーＳ_K ＝Ｓ_kij は正しいものと判定して出力する。
【０２４０】
また、鍵判定用情報の他の例として、２回以上暗号化または復号を行ったもの、例えば、Ｅ_SK（Ｅ_SK（Ｓ_K ））、Ｄ_SK（Ｄ_SK（Ｓ_K ））、あるいは各Ｅ_Mki （Ｓ_K ）に対応してＥ_Mki （Ｅ_Mki （Ｓ_K ））を設けるものなど種々のものが考えられる。
【０２４１】
また、各実施形態では、鍵判定用情報をもとに（方法１）〜（方法５）で示した手順を用いて、復号により得られた鍵が第１のセッションキーが正しいものであることを判定したが、ＤＶＤ等の記録媒体にｉの順番ですべてのＥ_Mki （Ｓ_K ）を記録しておき、復号ユニットにはｉとＭ_kiを対応付けて登録しておくことにより、鍵判定用情報、鍵判定手順、そのための構成を省略することができる。なお、あるｉについてのＭ_kiが使用不可となった場合には、ＤＶＤ等の記録媒体にＥ_Mki （Ｓ_K ）の代わりに無効を示す情報を格納するのが望ましい。
【０２４２】
次に、図１１を参照しながら、ＤＶＤ−ＲＯＭを例に取り上げ、上記した第３の実施形態を用いたディスクメーカ（映画、音楽等の著作物のＤＶＤを制作するメーカとする）とプレーヤメーカ（単体のＤＶＤプレーヤのメーカとする）とマスターキーを管理する鍵管理組織による鍵の管理方法等について説明する。なお、Ｄａｔａは、コンテンツの他に、前述したように鍵情報である場合もある（Ｄａｔａが鍵情報Ｓ_ktである場合のこの鍵情報Ｓ_ktを用いた暗号化や復号等についての説明は省略する）。なお、図１１において、処理等に用いる計算機等については省略してある。
【０２４３】
また、図１２には暗号化のためのシステムに関して説明するための図を示す。図１２の暗号化回路３０１，３１２，３０３は、同一の装置（計算機等）上に搭載される場合と、異なる装置（計算機等）上に搭載される場合があり、後者の場合には、装置間で情報の受け渡しが行われる。また、暗号化回路３０１，３１２，３０３は、ハードウェアで構成することも、ソフトウェアで構成することも可能である。
【０２４４】
ここでは、上記した（方法３）のＤＶＤにはｉ＝１〜ｎのすべてに対応するｎ個のマスターキーＥ_MKi （Ｓ_K ）を記録し、ＤＶＤプレーヤ（復号化ユニット１１４ｂ）内にはｊを１〜ｎのうちから予め選択されたｍ（２＜ｍ＜ｎ）種類のものとするｍ個のマスターキーＭ_kjを備える場合について説明する。なお、ＤＶＤプレーヤメーカにはマスターキーＭ_kjを排他的に割り当てるものとする。また、ここでは、ｎ＝１００、ｍ＝１０とする。
【０２４５】
また、ここでは、鍵判定用情報として、ＤＶＤにはＥ_SK（Ｓ_K ）を記録する方法を用いるものとする（図１２の３０２の部分は、鍵判定用情報をＥ_SK（Ｓ_K ）とした場合のものである）。
【０２４６】
まず、鍵管理組織２００では、マスターキーＭ_Ki（ｉ＝１〜１００）を保管している。マスターキーに数は、プレーヤメーカの新規参入や破られた場合の予備等のために、余分に設定しておくのが望ましい。
【０２４７】
鍵管理組織２００では、各プレーヤメーカ２０１〜２０３に、排他的にマスターキーＭ_Ki（ｉ＝１〜１００）を割り当てる。例えば、図１１のように、プレーヤメーカＡにマスターキーＭ_Ki（ｉ＝１０〜１９）を、プレーヤメーカＢにマスターキーＭ_Ki（ｉ＝２０〜２９）を、プレーヤメーカＣにマスターキーＭ_Ki（ｉ＝３０〜３９）を割り当てる。鍵管理組織２００（の計算機等）から各プレーヤメーカ（の計算機等）には、割り当てたマスターキーを通信媒体あるいは記録媒体等により送付する。その際、暗号通信等を用いて安全に受け渡しするのが望ましい。
【０２４８】
各プレーヤメーカは、個別に、鍵管理組織２００から割り当てられたマスターキーを管理する。そして、各プレーヤメーカは、この割り当てられたマスターキーを用いて、第３の実施形態で示したような構成を有するＤＶＤプレーヤを製造して販売する。
【０２４９】
一方、ここでは、鍵管理組織２００からディスクメーカ２２１〜２２３へは、マスターキーのプレインデータは渡さないようにするものとする。
【０２５０】
まず、各ディスクメーカ（ａとする）は、自身で第１のセッションキーＳ_k を決め（例えばディスク毎に決め）、第１のセッションキーＳ_k を鍵管理組織２００に渡す。鍵管理組織２００は、受け取った第１のセッションキーＳ_k を全てのマスターキーＭ_Ki（ｉ＝１〜１００）でそれぞれ暗号化してＥ_Mki （Ｓ_K ）、 （ｉ＝１〜１００）を得る（図１２の暗号化回路３０１を用いる）。そして、鍵管理組織２００は、Ｅ_Mki （Ｓ_K ）、（ｉ＝１〜１００）を、ディスクメーカａに渡す。
【０２５１】
鍵管理組織２００（の計算機等）とディスクメーカ（の計算機等）との間での情報の受け渡しも、上記と同様に、割り当てたマスターキーを通信媒体あるいは記録媒体等にて暗号通信等を用いて安全に行うのが望ましい。
【０２５２】
ディスクメーカａでは、Ｅ_Mki （Ｓ_K ）、（ｉ＝１〜１００）と、Ｅ_SK（Ｓ_K ）と、Ｅ_SK（Ｄａｔａ））とをＤＶＤ２３１に記録して販売する。なお、Ｓ_K 自身でＳ_K を暗号化してＥ_SK（Ｓ_K ）を得る操作は、ディスクメーカ側で行う方法と、マスターキーによる暗号化と同様に鍵管理組織２００側で行う方法とがある（図１２の暗号化回路３１２を用いる）。また、少なくとも、コンテンツの暗号化はディスクメーカにて行うものとする（図１２の暗号化回路３０３を用いる）。
【０２５３】
ディスクメーカａでは、例えば、Ｓ_K について、受け取ったＥ_Mki （Ｓ_K ）と鍵判定用情報であるＥ_SK（Ｓ_K ）とＥ_SK（Ｄａｔａ）（あるいはＤａｔａ）について管理する。
【０２５４】
他のディスクメーカについても同様である。
【０２５５】
なお、万一、マスターキーが破られたことが発覚した場合、それ以降、その破られたマスターキーを用いずに、ＤＶＤを制作するようにする。例えば、ｉ＝１９のマスターキーが破られた場合、ＤＶＤには、ｉ＝１〜１８、２０〜１００の９９個に対応するＥ_Mki （Ｓ_K ）が記録される。
【０２５６】
また、マスターキーが破られたことが発覚した場合、それ以降、その破られたマスターキーが割り当てられているプレーヤメーカでは、これを除いてＤＶＤプレーヤを製造して販売するようにするのが望ましい。例えば、ｉ＝１９のマスターキーが破られた場合、プレーヤメーカＡは、ｉ＝１０〜１８のマスターキーを用いてＤＶＤプレーヤを製造して販売する。
【０２５７】
また、既に販売されたｉ＝１９のマスターキーを持つてＤＶＤプレーヤについては、そのまま使用しても構わない。ただし、ユニット交換等によってｉ＝１９のマスターキーを持たないようにしてもよい。
【０２５８】
従って、マスターキーを安全かつ有効に管理できるとともに、不正なマスターキー解読に対するリスクを分散し、マスターキー解読後も上記システムが安全かつ有効に機能するようにすることができる。
【０２５９】
本発明は、上述した実施の形態に限定されるものではなく、その技術的範囲において種々変形して実施することができる。
【０２６０】
【発明の効果】
本発明によれば、複数のマスターキーのうちの少なくとも１つを持つ正当なプレーヤのみが、セッションキーを得ることができ、従ってマスターキーで暗号化されたコンテンツのプレインデータを得ることができる。この結果、不正なコピーにより、メディアを販売する不法な行為を防止し、著作権を守ることができる。
【図面の簡単な説明】
【図１】本発明の第１の実施形態に係るシステムの構成を示すブロック図
【図２】同実施形態の動作を示すフローチャート
【図３】記録媒体に暗号化された鍵と暗号化されたデータを格納する形式の一例を示す図
【図４】ＣＰＵ ＢＵＳからデータを保存した場合について説明するための図
【図５】本発明の第２の実施形態に係るシステムの構成を示すブロック図
【図６】鍵判定部の内部構成の例を示す図
【図７】同実施形態の動作を示すフローチャート
【図８】同実施形態の動作を示すフローチャート
【図９】本発明の第３の実施形態に係るシステムの構成を示すブロック図
【図１０】同実施形態の動作を示すフローチャート
【図１１】鍵の管理方法について説明するための図
【図１２】暗号化について説明するための図
【符号の説明】
１０１…ＤＶＤ
１０２，２０２…マスターキーを用いて暗号化された第１のセッションキー
１０３，２０３…第１のセッションキーを用いて暗号化された画像データ
１０４…暗号化回路
１０５…マスターキー
１０６…第２のセッションキー
１０７…暗号化ユニット
１０８…マスターキーを用いて復号された第２のセッションキー
１０９…第２のセッションキーを用いて暗号化された、マスターキーを用いて暗号化された第１のセッションキー
１１０…ＣＰＵ ＢＵＳ
１１１…セッションキー生成回路
１１２…復号化回路
１１３…第１のセッションキー
１１４，１１４ａ，１１４ｂ…復号化ユニット
１１５…ＭＰＥＧデコーダ回路
１１６…ディジタル／アナログ変換回路
２０９…ＤＶＤの読み出し出力から別の媒体にコピーするための線
２１０…ＣＰＵ ＢＵＳから別の媒体にコピーするための線
２１１…ディジタル記憶媒体
２００…鍵管理組織
２０１〜２０３…プレーヤメーカ
２２１〜２２３…ディスクメーカ
２３１〜２３３…ＤＶＤ
３０１，３１２，３０３…暗号化回路[0001]
BACKGROUND OF THE INVENTION
  The present invention relates to a key processing method and a disk manufacturer side processing apparatus for preventing data recorded on digital recording from being copied from a recording medium.
[0002]
[Prior art]
Conventionally, as a medium for recording digitized information (for example, a document, sound, image, program, etc.), there are a compact disk and a laser disk as a sound and image recording medium. In addition, a program or data recording medium such as a computer includes a floppy disk and a hard disk. In addition to these recording media, DVDs (digital video discs), which are large-capacity recording media, have been developed.
[0003]
In various digital recording media as described above, digital data is recorded as it is (including those that can be decoded and compressed), so the recorded data can be copied to other media. To do so, for example, it is possible to easily copy without loss of sound quality and image quality, to make a large number of duplicates, and there has been a problem such as infringement of copyright.
[0004]
[Problems to be solved by the invention]
As described above, when copying from a digital recording medium, there is no deterioration in sound quality and image quality, and copying can be performed while maintaining the sound quality and image quality of the master. For this reason, there has been a problem that an illegal act of selling media without paying a copyright fee can be performed by an illegal copy called a pirated version.
[0005]
  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a key processing method and a disk manufacturer side processing apparatus for preventing unauthorized copying from a digitally recorded recording medium.
[0006]
[Means for Solving the Problems]
  The present invention is provided in a disk manufacturer side that supplies a disk on which encrypted content is recorded, and includes a session key generation unit, a transfer unit, an encryption unit, and a recording unit. A key processing method comprising: a step of generating a session key by the session key generating means; and the generated session key is provided in advance on the key management organization side via the communication medium by the delivery means. Supplying a plurality of master keys to the key management organization side processing device stored in the storage means, and key information created by the key management organization side processing device, each encrypted with the plurality of master keys, Received from the processing device on the key management organization side via the communication medium by the delivery means, and the security means by the encryption means. Recording the content encrypted with the session key, the content encrypted with the session key, and the key information received from the processing device on the key management organization side onto the disk to be supplied by the recording means And a step.
  Further, the present invention is a disc manufacturer side processing device provided on the disc manufacturer side that supplies a disc on which encrypted content is recorded, the means for generating a session key, and the generated session key, The session created on the key management organization side processing apparatus, which is provided on the key management organization side, supplied to the key management organization side processing apparatus stored in the storage means in advance, via the communication medium Delivery means for receiving key information obtained by encrypting keys with the plurality of master keys, means for encrypting content with the session key, content encrypted with the session key, and the key management organization side processing device And recording means for recording the key information received from the disk to be supplied.
  According to the present invention, only a legitimate player having at least one of a plurality of master keys can obtain a session key, and thus can obtain plain data of content encrypted with the master key. As a result, illegal copying of media can be prevented by illegal copying and copyright can be protected.
  In addition, according to the present invention, for example, the encryption unit and the decryption unit can be designed separately from the core part of the reproduction part of a digital recording / reproduction device, etc. It is only necessary to exchange the encryption unit and the decoding unit.
[0016]
Each of the inventions related to the above devices is also established as an invention related to a method and an invention related to a storage medium, and each invention related to the above method is an invention related to an apparatus and an invention related to a storage medium, respectively. Also holds.
[0017]
The first aspect of the present invention also provides a digital recording medium that records digital data encrypted with a predetermined first session key and a first session key encrypted with a predetermined master key. A decryption method for obtaining plaintext of data, wherein a decryption unit generates a second session key based on a predetermined random number, and decrypts the generated second session key with the master key The second session key decrypted with the master key is transmitted from the decryption unit to the encryption unit, and the second session key decrypted with the transmitted master key is transmitted by the encryption unit, Encrypting with the master key, taking out the second session key, and using the second session key taken out by the encryption unit, the recording medium The first session key encrypted with the master key read out from the server is encrypted, and encrypted from the encryption unit to the decryption unit using the second session key, and encrypted with the master key. The first session key encrypted with the master key encrypted with the transmitted second session key at the decryption unit. Decrypting using the second session key, extracting the first session key encrypted with the master key, and further extracting the first session key encrypted with the extracted master key with the master key. Decrypting and taking out the first session key, and using the taken out first session key, the first session key read out from the recording medium It decodes the digital data encrypted with the session key, and wherein the obtaining the plaintext of the digital data.
[0018]
The present invention 2 includes digital data encrypted with a predetermined first session key, a first session key encrypted with a predetermined master key of a plurality of predetermined master keys, A decryption method for obtaining a plaintext of the digital data from a recording medium on which a first session key encrypted with one session key itself is recorded, wherein a decryption unit generates a predetermined random number To generate a second session key, decrypt the generated second session key with a predetermined master key, and decrypt it with the predetermined master key from the decryption unit to the encryption unit. The second session key is transmitted, and the second session key decrypted with the transmitted predetermined master key is transmitted by the encryption unit to the predetermined session key. The second session key is extracted by encrypting with a star key, and the encryption unit encrypts with the predetermined master key read from the recording medium using the second session key extracted. The encrypted first session key is encrypted, and the first session key itself read out from the recording medium is encrypted using the extracted second session key. Encrypting the session key, transmitting the first session key encrypted with the predetermined master key, encrypted with the second session key, from the encryption unit to the decryption unit; The first session key encrypted using the first session key and encrypted with the first session key itself is transmitted to the decryption unit. The first session key encrypted with the predetermined master key encrypted using the transmitted second session key is decrypted using the second session key, and the predetermined session key is decrypted. The first session key encrypted with the master key and the first session key encrypted with the transmitted first session key and encrypted with the transmitted second session key Is decrypted using the second session key, the first session key encrypted with the first session key itself is extracted, and the decryption unit encrypts it with the predetermined master key extracted. A first session key candidate obtained by decrypting the converted first session key with one of a plurality of predetermined master keys, and the extracted first session key When the first session key encrypted with one session key itself matches the one decrypted with the first session key candidate, the first session key candidate is designated as the predetermined first session. Using the obtained first session key as a key, the digital data encrypted with the first session key read from the recording medium is decrypted, and the plaintext of the digital data is obtained It is characterized by obtaining.
[0019]
The third aspect of the present invention includes a digital data encrypted with a predetermined first session key, a first session key encrypted with a plurality of predetermined master keys, and the first session key itself. A decryption method for obtaining a plaintext of the digital data from a recording medium on which an encrypted first session key is recorded, wherein a second session based on a predetermined random number is performed in the decryption unit Generate a key, decrypt the generated second session key with a predetermined master key, and transmit the second session key decrypted with the predetermined master key from the decryption unit to the encryption unit And the encryption unit encrypts the second session key decrypted with the predetermined master key transmitted with the predetermined master key, and The session key is extracted, and the encryption unit encrypts the first session key encrypted with the master key read from the recording medium, using the extracted second session key. The first session key encrypted with the first session key read from the recording medium is encrypted using the extracted second session key, and the decryption unit is decrypted from the encryption unit. And transmitting the first session key encrypted with the master key, encrypted with the second session key, and encrypted with the second session key, The first session key encrypted with the session key itself is transmitted, and the decryption unit uses the transmitted second session key. The encrypted first session key encrypted with the master key is decrypted with the second session key, and the first session key encrypted with the master key is extracted and transmitted. The first session key encrypted with the first session key itself, decrypted with the second session key, and decrypted with the second session key, The first session key encrypted with the session key itself is extracted, and the decryption unit decrypts the first session key encrypted with the extracted master key with the predetermined master key. The first session key candidate and the first session key encrypted with the extracted first session key itself are used as the first session key candidate. When the first session key candidate is used as the predetermined first session key and the obtained first session key is used, the first session key candidate is read from the recording medium. The digital data encrypted with the first session key is decrypted to obtain a plaintext of the digital data.
[0020]
The present invention 4 includes digital data encrypted with a predetermined first session key, a first session key encrypted with a plurality of predetermined master keys, and the first session key itself. A decryption method for obtaining a first session key used for decrypting the digital data from a recording medium on which an encrypted first session key is recorded, wherein the first session key is encrypted with the master key. The session key is decrypted with a predetermined one of the plurality of master keys to generate a first session key candidate, and the generated first session key candidate is used to generate the first session key candidate. The first session key encrypted with the session key itself is decrypted, and the first session key candidate and the first session key candidate decrypted by using the first session key candidate The first session key encrypted with the session key itself is compared, and if they match in the comparison, the first session key candidate is determined as the predetermined first session key. .
[0021]
A fifth aspect of the present invention is characterized in that, in any one of the first to third aspects of the present invention, the encryption unit and the decryption unit are integrated circuit elements formed independently.
[0022]
A sixth aspect of the present invention is characterized in that, in any one of the first to third aspects, transmission performed between the encryption unit and the decryption unit is performed using a CPU BUS.
[0023]
The present invention 7 is the invention according to any one of the above inventions 1 to 3, wherein the predetermined random number changes at least every time the recording medium is reproduced.
[0024]
The present invention 8 is characterized in that, in any one of the inventions 1 to 3, the predetermined random number is generated based on time information obtained at a predetermined timing.
[0025]
The predetermined timing is, for example, a timing when the recording medium is mounted on the driving device.
[0026]
A ninth aspect of the present invention is characterized in that, in any one of the first to fourth aspects, the data includes at least one of key information, a document, sound, an image, and a program.
[0027]
According to the tenth aspect of the present invention, there is provided a recording medium that records digital data encrypted with a predetermined first session key and a first session key encrypted with a predetermined master key. A decryption device for obtaining plaintext, the second session key generation means provided in the decryption unit for generating a different second session key according to a predetermined condition, and the generated second session key Decrypting the session key with the master key in the decryption unit, transmitting the data into the encryption unit, and encrypting the second session key with the master key in the encryption unit The data is encrypted with the master key read out from the recording medium using the extracting means and the second session key extracted by the means Means for encrypting the first session key and transmitting it to the decryption unit; and the encrypted first session key transmitted by the means into the decryption unit generated in the decryption unit. Means for obtaining the first session key by decrypting using the master key after decrypting using the second session key, and using the first session key obtained by the means, the recording medium Means for decrypting the digital data encrypted with the first session key read out from the data to obtain a plaintext of the digital data.
[0028]
The present invention 11 is characterized in that, in the above invention 10, the second session key generation means generates a different second session key every time the recording medium is decrypted or according to time information. To do.
[0029]
A recording medium according to a twelfth aspect of the present invention includes a digital data encrypted with a predetermined first session key, a first session key encrypted with a plurality of predetermined master keys, The first session key encrypted with the session key itself is recorded.
[0030]
The recording medium can be applied to various media such as a DVD, CD-ROM, floppy disk, and hard disk.
[0031]
Each of the inventions related to the above devices is also established as an invention related to a method and an invention related to a storage medium, and each invention related to the above method is an invention related to an apparatus and an invention related to a storage medium, respectively. Also holds.
[0032]
According to the present invention, even if the data flowing in the signal line connecting the encryption unit and the decryption unit is stored, the data is encrypted and is necessary for encrypting the data. Since the information is generated based on random numbers and cannot be reproduced later, the stored data cannot be reproduced or used even if the master key in the decryption unit is broken. .
[0033]
As a result, illegal copying of media can be prevented by illegal copying and copyright can be protected.
[0034]
In addition, according to the present invention, the encryption unit and the decryption unit can be designed separately from the core part of the playback part of the digital recording / playback device, so that even if the encryption is broken, the encryption unit and the decryption unit It is only necessary to replace the conversion unit.
[0035]
According to the present invention, the digital data encrypted with the predetermined first session key and the first encrypted with the predetermined master key among the plurality of predetermined master keys are recorded on the recording medium. Recording one session key and the first session key encrypted with the first session key itself, so that the predetermined master key is any of a plurality of master keys, The decryption unit having a plurality of master keys can extract the first session key and decrypt the data using the first session key.
[0036]
According to the present invention, on the recording medium, digital data encrypted with a predetermined first session key, a first session key encrypted with a plurality of predetermined master keys, and By recording the first session key encrypted with the first session key itself, the decryption unit having at least one of the plurality of master keys allows the first session to be recorded. The key can be taken out and the data can be decrypted by this first session key.
[0037]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the invention will be described with reference to the drawings.
[0038]
In the present embodiment, the operation of encrypting certain data a using the key K is E_KAn operation for expressing a data a using a key K as D_KExpressed as (a). By using this expression, for example, an operation of encrypting and decrypting a certain data a using the key K can be expressed as D_K(E_K(A)).
[0039]
In this embodiment, certain data is first decrypted, and then the decrypted data may be restored to the original data. This is based on the fact that the decryption of data has the same effect as encryption due to the nature of encryption. In other words, in order to restore the decrypted data, the key used for decryption must be known, and if the key is known, the decrypted data is encrypted to obtain the first decrypted data. . In this operation, if the encryption key is x and the data is y,
E_x(D_x(Y)) = y
It is represented by
[0040]
In the present embodiment, an example of a system that reads, decodes, decodes and reproduces image data recorded on a DVD and compressed and encrypted in accordance with a data compression standard called MPEG2 will be described.
[0041]
(First embodiment)
The first embodiment will be described below.
[0042]
FIG. 1 is a block diagram showing a configuration of a system according to the first embodiment of the present invention. An example of the operation of this embodiment is shown in the flowchart of FIG.
[0043]
The system according to the present embodiment is connected to a so-called CPU BUS of a CPU (not shown) used for reproduction provided in a computer such as a personal computer, and is encrypted data (E described later)._SK(Data)) is configured to flow on the CPU BUS. In FIG. 1, only the portion related to the CPU used for reproduction is shown.
[0044]
As shown in FIG. 1, the system according to the present embodiment is a DVD drive device (not shown) for reading data from the DVD 101, connected to the DVD drive device without a CPU BUS, or built in the DVD drive device. The encryption unit 107 and the decryption unit 114 are provided.
[0045]
The encryption unit 107 and the decryption unit 114 are connected to the CPU BUS110. Output of data from the decryption unit 114 is performed through, for example, an I / O port other than the CPU BUS. That is, in this embodiment, data input / output is performed without going through the CPU BUS, but the CPU BUS is used for data transfer between the encryption unit 107 and the decryption unit 114.
[0046]
The encryption unit 107 includes a demodulation / error correction circuit 117, a demodulation / error correction circuit 118, and an encryption circuit 104. In FIG. 1, two encryption circuits 104 are shown in the encryption unit 107, but it is assumed that there is actually one encryption circuit. It is assumed that the encryption unit 107 is formed as an independent IC chip. Note that the demodulation / error correction circuit 117 and the demodulation / error correction circuit 118 may not be provided in the encryption unit 107 but may be provided on the side of the preceding unit or the like (inside the DVD drive device).
[0047]
On the other hand, the decryption unit 114 includes the decryption circuit 112 and the second session key S._KA session key generation circuit 111 for generating '. In the present embodiment, it is assumed that the decoding unit 114 includes an MPEG decoder circuit 115 and a conversion circuit 116 that converts decoded image data from digital to analog. In FIG. 1, four decoding circuits 112 are shown in the decoding unit 114, but it is assumed that there is actually one decoding circuit. The decryption unit 114 is formed as an independent IC chip.
[0048]
Also, a master key to be described later is registered (created) in the encryption unit 107 and the decryption unit 114. The master key is recorded in a secret area inside the chip so that the user cannot intentionally take it out in each of the chip of the encryption unit and the chip of the decryption unit so that the user cannot obtain it from the outside. Shall.
[0049]
The overall control is controlled by a control unit (not shown). The control unit can be realized, for example, by executing a program by the CPU of the computer. Specific examples of control by the control unit include an instruction relating to reading of data from a DVD, designation of a data transmission destination, an instruction relating to data output from the decoding unit 114, and the like. In addition, for example, the trigger for starting the control unit may be triggered by a user via a user interface or may be triggered by a process in an application program.
[0050]
In the present embodiment, the first session key is S_K, Set the second session key to S_K′ 、 Master key is M_KImage data (that is, a group of encrypted data) is represented by Data. These are all plaintext.
[0051]
In FIG. 1, 102 is the first session key S._KMaster key M_KE generated by encryption using_MK(S_K), 103 designates the image data Data as the first session key S._KE generated by encryption using_SK(Data), 105 is the master key M_K106 is the second session key S_K′, 108 is the second session key S_K'Is the master key M_KD decrypted using_MK(S_K′), 109 is the master key M_KThe first session key E encrypted using_MK(S_K) To the second session key S_KE encrypted with '_{SK ′}(E_MK(S_K)), 113 is the first session key S_KRespectively.
[0052]
As shown in FIG. 3, on the DVD 101, the first session key S_KMaster key M_KE generated by encryption using_MK(S_K) Stores the image data Data in the first session key S in the key recording area (lead-in area) in the innermost periphery._KE generated by encryption using_SK(Data) is recorded in the data recording area (data area).
[0053]
The operation of this embodiment will be described below with reference to the flowchart of FIG.
[0054]
In step S1, a master key M recorded on the DVD 101 by a DVD drive device (not shown)._KThe first session key E encrypted using_MK(S_K) And read into the encryption unit 107. At this time, the demodulation / error correction circuit 117 performs demodulation and error correction in the data.
[0055]
On the other hand, in step S2, in the decryption unit 114, the session key generation circuit 111 receives a random number, for example, time information from a clock (not shown) as an input, and receives the second session key S._K′ Is generated. Then, in the decryption circuit 112, the generated second session key S_K′, Master key M_KDecrypt using D_MK(S_K′) Is generated and sent to the encryption unit 107 through the CPU BUS 110.
[0056]
As a timing for generating the random number (for example, a timing for inputting time information), for example, a timing at which a signal indicating that the DVD 101 is mounted on the DVD drive apparatus is asserted can be used.
[0057]
Alternatively, the session key generation circuit 111 may be composed of a random number generator for the key length, for example. Note that when a key is generated with a random number in which all bits may be 0 or 1, it is necessary to perform a check process or the like so that all bits do not become 0 or 1.
[0058]
In step S3, the encryption unit 107 receives the D received through the CPU BUS 110 in the encryption circuit 104._MK(S_K′), Master key M_KEncrypt using. That is,
E_MK(D_MK(S_K′)) = S_K′
Thus, the second session key S generated by the session key generation circuit 111 in the decryption unit 114 is_K'Can be obtained.
[0059]
Here, the second session key S generated by the session key generation circuit 111_K'Is not understood even if it is stolen on the CPU BUS110.
[0060]
Next, in step S4, the cryptographic unit 107 uses the second session key S obtained as described above._K′, The encrypted first session key E recorded on the DVD 101_MK(S_K) And E_{SK ′}(E_MK(S_K)) And sends it to the decryption unit 114 through the CPU BUS 110.
[0061]
Next, in step S5, in the decryption unit 114, the decryption circuit 112 receives the E received through the CPU BUS110._{SK ′}(E_MK(S_K)) For the second session key S_KDecrypt using '
D_{SK ′}(E_{SK ′}(E_MK(S_K))) = E_MK(S_K)
Get.
[0062]
Further, in the decoding circuit 112, the obtained E_MK(S_K), Master key M_KDecrypt using
D_MK(E_MK(S_K)) = S_K
And the first session key S_KCan be obtained.
[0063]
In this way, the first session key S_KIn step S6, the first session key S recorded on the DVD 101 by a DVD drive device (not shown) is obtained._KEncrypted image data E_SK(Data) is read and taken into the encryption unit 107. At that time, the demodulation / error correction circuit 118 performs demodulation and error correction in the data. And E_SK(Data) is sent to the encryption unit 107 through the CPU BUS110.
[0064]
Next, in step S7, in the decryption unit 114, the decryption circuit 112 receives the E received through the CPU BUS110._SK(Data) to the first session key S_KDecrypt using
D_SK(E_SK(Data)) = Data
Thus, the encrypted image data can be decrypted to obtain plain data.
[0065]
For example, data to be decoded (ie, E_SKStep S6 and step S7 are repeated until the processing of (Data)) ends or until it is requested to stop the processing.
[0066]
When the image data Data obtained as described above is compressed in accordance with, for example, the data compression standard of MPEG2, it is decoded by the MPEG decoder circuit 115 and converted into an analog signal by the D / A conversion circuit 116. Then, it is sent to a video device such as a television (not shown) and reproduced.
[0067]
Note that either step S1 or steps S2 and S3 may be executed first.
[0068]
In addition, for execution of step S6 and step S7, one E_SKA method of sequentially performing in units of (Data), or a predetermined number of E in step S6_SK(Data) is read and temporarily stored in a buffer or the like. Next, in step S7, E in the buffer is read._SKA method of decoding (Data) or a method of performing steps S6 and S7 in a pipeline process is conceivable.
[0069]
Also, the image data E is sent from the decoding circuit 112 to the MPEG decoder circuit 115._SK  When transferring (Data), it may be transferred in units of one Data, or may be transferred in units of a predetermined number of Data.
[0070]
As described above, according to the present embodiment, when reproducing a medium in which the digitized data is encrypted and recorded (when decrypting the encrypted data), the decrypted data is stored in the CPU BUS of the computer. The second session key S used for encrypting the first session key that does not flow and is necessary for decryption of the encrypted data flowing to the CPU BUS_K'Is generated based on information that changes every time data is reproduced, for example, time information. For example, even if data flowing through the CPU BUS 110 is stored in the digital storage medium 211 from the signal line 210 as shown in FIG. It cannot be reclaimed or used.
[0071]
As a result, illegal copying of media can be prevented by illegal copying and copyright can be protected.
[0072]
In this embodiment, the circuit used for encryption and decryption can be designed separately from the core of the playback portion of a digital recording / playback device such as a DVD as can be seen from FIG. Even so, it is only necessary to exchange the decryption unit 114 (or the encryption unit 107 and the decryption unit 114).
[0073]
In the present embodiment, the encryption unit 107 has one encryption circuit, but two encryption circuits may be provided. The decoding unit 114 has one decoding circuit, but may be provided as two, three, or four decoding circuits. In these cases, it is preferable to make the corresponding encryption circuit and decryption circuit independent or shared in a set.
[0074]
In addition, when the corresponding encryption circuit and decryption circuit are made independent as a set, the corresponding encryption circuit and decryption circuit that are made independent adopt a different encryption method from other encryption circuits and decryption circuits. It doesn't matter.
[0075]
(Second Embodiment)
Next, a second embodiment will be described.
[0076]
In the present embodiment, for example, a plurality of predetermined master keys are prepared, and one or a plurality of master keys are prepared for each predetermined unit such as a manufacturer of a decoding unit (or a DVD production / sales company). An example suitable for such allocation will be described.
[0077]
FIG. 5 is a block diagram showing a configuration of a system according to the second embodiment of the present invention. An example of the operation of this embodiment is shown in the flowcharts of FIGS.
[0078]
The system according to the present embodiment is connected to a so-called CPU BUS of a CPU (not shown) used for reproduction provided in a computer such as a personal computer, and encrypted data (E_SK(Data)) is configured to flow on the CPU BUS. FIG. 5 shows only the part related to the CPU used for reproduction.
[0079]
As shown in FIG. 5, the system according to this embodiment is a DVD drive device (not shown) for reading data from the DVD 101, connected to the DVD drive device without a CPU BUS, or built in the DVD drive device. And an encryption unit 107 and a decryption unit 114a.
[0080]
The encryption unit 107 and the decryption unit 114a are connected to the CPU BUS110. Data output from the decryption unit 114a is performed through, for example, an I / O port other than the CPU BUS. That is, in the present embodiment, data input / output is performed without going through the CPU BUS, but the CPU BUS is used for data transfer between the encryption unit 107 and the decryption unit 114a.
[0081]
The encryption unit 107 includes a demodulation / error correction circuit 117, a demodulation / error correction circuit 118, and an encryption circuit 104. In FIG. 1, two encryption circuits 104 are shown in the encryption unit 107, but it is assumed that there is actually one encryption circuit. It is assumed that the encryption unit 107 is formed as an independent IC chip. Note that the demodulation / error correction circuit 117 and the demodulation / error correction circuit 118 may not be provided in the encryption unit 107 but may be provided on the side of the preceding unit or the like (inside the DVD drive device).
[0082]
On the other hand, the decryption unit 114a includes the decryption circuit 112 and the second session key S._K'Includes a session key generation circuit 111 and a key determination circuit 120.
[0083]
Here, FIG. 6 shows a configuration example of the key determination circuit 120. The key determination circuit 120 includes a decryption circuit 112, a comparison circuit 121, and a gate circuit 122. In the present embodiment, it is assumed that the decoding unit 114a includes an MPEG decoder circuit 115 and a conversion circuit 116 for converting decoded image data from digital to analog.
[0084]
In FIG. 5 and FIG. 6, the decryption unit 114a includes a total of five decryption circuits 112 including the two decryption circuits 112 in the key determination circuit 120. Assume that there are two decoding circuits.
[0085]
It is assumed that the decryption unit 114a is formed as one independent IC chip.
[0086]
A master key described later is registered (built in) in the encryption unit 107 and the decryption unit 114a. The master key is recorded in a secret area inside the chip so that the user cannot intentionally take it out in each of the chip of the encryption unit and the chip of the decryption unit so that the user cannot obtain it from the outside. Shall.
[0087]
The overall control is controlled by a control unit (not shown). The control unit can be realized, for example, by executing a program by the CPU of the computer. Specific examples of the control by the control unit include an instruction relating to reading of data from a DVD, designation of a data transmission destination, an instruction relating to data output from the decoding unit 114a, and the like. In addition, for example, the trigger for starting the control unit may be triggered by a user via a user interface or may be triggered by a process in an application program.
[0088]
In the present embodiment, the first session key is S_K, Set the second session key to S_K', The t-th of the n types of master keys is M_kt(Where t = 1 to n), image data (however, a group of encrypted data) is represented by Data. These are all plaintext.
[0089]
In FIG. 1, 102-1 is the first session key S._KMaster key M_kiE generated by encryption using_MKi(S_K), 102-2 is the first session key S_KTo the first session key S_KE generated by self-encryption_Sk(S_K), 103 designates the image data Data as the first session key S._KE generated by encryption using_SK(Data), 105 is the master key M_kj106 is the second session key S_K′, 108 is the second session key S_K'Is the master key M_kjD decrypted using_Mkj(S_K'), 109-1 is the master key M_kiThe first session key E encrypted using_MKi(S_K) To the second session key S_KE encrypted with '_{SK ′}(E_MKi(S_K)), 109-2 is the first session key S_KFirst session key E encrypted by itself_Sk(S_K) To the second session key S_KE encrypted with '_{SK ′}(E_Sk(S_K)), 113 is the first session key S_KRespectively.
[0090]
Here, the first session key S recorded on the DVD 101_KMaster key M_kiE generated by encryption using_MKi(S_K) And the master key M held in the decryption unit 114a_kjFor the setting of the number of types, for example, several methods are conceivable as shown below.
[0091]
(Method 1) The DVD 101 has one master key E in which i is any one of 1 to n._MKi(S_K) And n master keys M corresponding to all of j = 1 to n are stored in the decryption unit 114a._kjIs provided.
[0092]
(Method 2) The DVD 101 has n master keys E corresponding to all i = 1 to n._MKi(S_K) And one master key M in which j is any one of 1 to n in the decryption unit 114a_kjIs provided.
[0093]
(Method 3) This is an extension of the above (Method 2). The DVD 101 has n master keys E corresponding to all i = 1 to n._MKi(S_K) And m master keys M in the decryption unit 114a, where j is m (2 <m <n) types preselected from 1 to n._kjIs provided.
[0094]
Specific examples of numerical values include, for example, n = 100 or n = 400, and m = 2, 3, 4, or 10, but are not limited thereto.
[0095]
(Method 4) In the example in which the DVD and the decoding unit are reversed in the above (Method 3), the DVD 101 has m (2 <m <n) types in which i is preselected from 1 to n. M master keys E_MKi(S_K) And n master keys M corresponding to all of j = 1 to n are stored in the decryption unit 114a._kjIs provided.
[0096]
(Method 5) The DVD 101 has n master keys E corresponding to all i = 1 to n._MKi(S_K) And n master keys M corresponding to all of j = 1 to n are stored in the decryption unit 114a._kjIs provided.
[0097]
In the methods 3 to 5, the decoding procedure is the same.
[0098]
As shown in FIG. 3, on the DVD 101, the first session key S_KMaster key M_kiOne (in the case of (Method 1) described above) or a plurality of (in the case of (Method 2) to (Method 5) above) generated by encryption using_MKi(S_K) Stores the image data Data in the first session key S in the key recording area (lead-in area) in the innermost periphery._KE generated by encryption using_SK(Data) is recorded in the data recording area (data area).
[0099]
In the decoding unit 114, n (in the case of (Method 1), (Method 4), (Method 5) above), 1 (in the case of (Method 2) above), or m (in the case of (Method 2) above) Master key M in the case of (Method 3) above_kjIs registered.
[0100]
It is assumed that one predetermined master key is registered in the encryption unit 107.
[0101]
Hereinafter, the (Method 1), (Method 2), and (Method 3 to Method 5) will be sequentially described.
[0102]
First, the operation of the present embodiment will be described with reference to the flowcharts of FIGS. 7 and 8 in the case of (Method 1).
[0103]
In step S11, a first session key S recorded on the DVD 101 by a DVD drive device (not shown)._KFirst session key E encrypted by itself_Sk(S_K) And read into the encryption unit 107. At this time, the demodulation / error correction circuit 117 performs demodulation and error correction in the data.
[0104]
In step S12, the master key M recorded on the DVD 101 by a DVD drive device (not shown)._kiThe first session key E encrypted using_Mki(S_K) (Any one of i = 1 to n; i is unknown here) is read and taken into the cryptographic unit 107. At this time, the demodulation / error correction circuit 117 performs demodulation and error correction in the data.
[0105]
On the other hand, in step S13, in the decryption unit 114a, the session key generation circuit 111 receives a random number, for example, time information from a clock (not shown) as an input, and receives the second session key S._K′ Is generated. Then, in the decryption circuit 112, the generated second session key S_K′, Master key M_kj(Where j is a predetermined one of 1 to n)_Mkj(S_K′) Is generated and sent to the encryption unit 107 through the CPU BUS 110.
[0106]
As a timing for generating the random number (for example, a timing for inputting time information), for example, a timing at which a signal indicating that the DVD 101 is mounted on the DVD drive apparatus is asserted can be used.
[0107]
Alternatively, the session key generation circuit 111 may be composed of a random number generator for the key length, for example. Note that when a key is generated with a random number in which all bits may be 0 or 1, it is necessary to perform a check process or the like so that all bits do not become 0 or 1.
[0108]
In step S 14, the encryption unit 107 receives the D received through the CPU BUS 110 in the encryption circuit 104._Mkj(S_K′), Master key M_kj(Where j is a predetermined one of 1 to n) is used for encryption. That is,
E_Mkj(D_Mkj(S_K′)) = S_K′
The second session key S generated by the session key generation circuit 111 in the decryption unit 114a_K'Can be obtained.
[0109]
Here, the second session key S generated by the session key generation circuit 111_K'Is not understood even if it is stolen on the CPU BUS110.
[0110]
Next, in step S15, the cryptographic unit 107 uses the second session key S obtained as described above._K′, The encrypted first session key E recorded on the DVD 101_Sk(S_K) And E_{SK ′}(E_Sk(S_K)) And sends it to the decryption unit 114a through the CPU BUS110.
[0111]
Similarly, in step S16, the cryptographic unit 107 uses the second session key S obtained as described above._K′, The encrypted first session key E recorded on the DVD 101_Mki(S_K) And E_{SK ′}(E_Mki(S_K)) And sends it to the decryption unit 114a through the CPU BUS110.
[0112]
Next, in step S17, in the decryption unit 114a, the decryption circuit 112 receives the E received through the CPU BUS110._{SK ′}(E_Sk(S_K)) For the second session key S_{K ′}Decrypt using
D_{SK ′}(E_{SK ′}(E_Sk(S_K))) = E_Sk(S_K)
Get.
[0113]
Similarly, in step S18, the decryption unit 114a receives the E received in the decryption circuit 112 through the CPU BUS110._{SK ′}(E_Mki(S_K)) For the second session key S_KDecrypt using '
D_{SK ′}(E_{SK ′}(E_Mki(S_K))) = E_Mki(S_K)
Get.
[0114]
Where E_Mki(S_K) Used to create the master key M_kiIs unknown, in step S19, the first session key S is used by using the key determination circuit 120 as shown below._KAsk for.
[0115]
First, the principle of the key determination process will be described.
[0116]
First, E_Mki(S_K) All master keys M_kjWhen decoding with (j = 1 to n) respectively,
S_kij= D_Mkj(E_Mki(S_K)) (J = 1 to n)
Is obtained. Where S_kijAny one of (j = 1 to n) is the first session key S_KIt is.
[0117]
Next, the above E_Sk(S_K) To generate the generated S_kijAny of (j = 1 to n) is the first session key S_KFind out if it is.
[0118]
So E_Sk(S_K) For all first session key candidates S_kijWhen decoding with (j = 1 to n) respectively,
S_k′ ′ (I, j) = D_Skij(E_Sk(S_K))
Is obtained.
[0119]
Where E_Mki(S_K) Used to create the master key M_kiSame master key M_kjIs used in the decoding unit, i.e., i = j, S_k′ ′ (I, j) = S_kij= S_KIt becomes.
[0120]
Therefore, each S_kij(J = 1 to n), S_k′ ′ (I, j) = S_kijBy examining whether (j = 1 to n) holds, S_k′ ′ (I, j) = S_kijS satisfying (j = 1 to n)_kijTo the first session key S_KCan be obtained as This S_kijThe master key used this time corresponds to j giving.
[0121]
This operation is expressed in C language using C language notation as follows.

The second line of the above procedure is M_kiUsing E_Mki(S_K) Is decrypted and assigned to DS1 [i].
[0122]
The third line of the above procedure is S_kiUsing E_Sk(S_K) Is decrypted and assigned to DS2 [i].
[0123]
The fourth line of the above procedure shows an operation for determining whether DS1 [i] and DS2 [i] match.
[0124]
The ninth line of the above procedure shows the operation when DS1 [i] and DS2 [i] do not match.
[0125]
For example, in the key determination circuit 120 of FIG. 6, the decryption circuit 112 first sets j = 1 and sets E = 1._Mki(S_K), Master key M_kjDecrypt with
S_kij= D_Mkj(E_Mki(S_K))
Get.
[0126]
Next, the decryption circuit 112 causes E_Sk(S_K) S_kijDecrypt with
S_k′ ′ = D_Skij(E_Sk(S_K))
Get.
[0127]
Next, the comparison circuit 121 performs the above S._k'And = S_kijIf they match, the gate circuit 122 is controlled and held._kij(Fig. 6 (a)) or S_k′ ”(FIG. 6B) is changed to the first session key S._KOutput as.
[0128]
If they do not match, the same operation is performed with the first session key S while increasing j by one._KRepeat until is obtained.
[0129]
In this way, the first session key S_KIn step S20, the first session key S recorded on the DVD 101 by a DVD drive device (not shown) is obtained._KEncrypted image data E_SK(Data) is read and taken into the encryption unit 107. At that time, the demodulation / error correction circuit 118 performs demodulation and error correction in the data. And E_SK(Data) is sent to the encryption unit 107 through the CPU BUS110.
[0130]
Next, in step S21, in the decryption unit 114a, the decryption circuit 112 receives the E received through the CPU BUS110._SK(Data) to the first session key S_KDecrypt using
D_SK(E_SK(Data)) = Data
Thus, the encrypted image data can be decrypted to obtain plain data.
[0131]
For example, data to be decoded (ie, E_SKSteps S20 and S21 are repeated until (Data)) is completed or until it is requested to stop processing.
[0132]
When the image data Data obtained as described above is compressed in accordance with, for example, the data compression standard of MPEG2, it is decoded by the MPEG decoder circuit 115 and converted into an analog signal by the D / A conversion circuit 116. Then, it is sent to a video device such as a television (not shown) and reproduced.
[0133]
Note that any of step S11, step S12, and steps S13 and S14 may be executed first.
[0134]
Further, any of steps S15 and S17 and steps S16 and S18 may be executed first.
[0135]
In addition, for execution of step S20 and step S21, one E_SKA method of sequentially performing in units of (Data), or a predetermined number of E in step S20_SK(Data) is read, temporarily stored in a buffer or the like, and then in step S21, E_SKA method of decoding (Data) or a method of performing step S20 and step S21 in a pipeline process is conceivable.
[0136]
Also, the image data E is sent from the decoding circuit 112 to the MPEG decoder circuit 115._SK  When transferring (Data), it may be transferred in units of one Data, or may be transferred in units of a predetermined number of Data.
[0137]
As described above, according to the present embodiment, as in the first embodiment, even if data flowing through the CPU BUS is stored, it cannot be reproduced or used.
[0138]
As a result, illegal copying of media can be prevented by illegal copying and copyright can be protected.
[0139]
In addition, according to the present embodiment, information directly indicating the master key used for encrypting the first session key recorded on the recording medium is unnecessary, and is determined in advance when recording on a DVD or the like. A master key can be selected and used as appropriate within the range. Another advantage is that a master key that can be used for each predetermined unit such as a DVD production / sales company can be assigned.
[0140]
Of course, in this embodiment as well, the circuit used for encryption and decryption can be designed separately from the core part of the playback part of a digital recording / playback device such as a DVD. Therefore, even if the encryption is broken, decryption is possible. It is only necessary to exchange the unit 114a (or the encryption unit 107 and the decryption unit 114a).
[0141]
In the present embodiment, the encryption unit 107 has one encryption circuit, but two encryption circuits may be provided. In addition, the decoding unit 114a has one decoding circuit, but two, three, four, or five decoding circuits may be provided. In these cases, it is preferable to make the corresponding encryption circuit and decryption circuit independent as a set.
[0142]
Also, when the corresponding encryption circuit and decryption circuit are made independent as a set, the corresponding encryption circuit and decryption circuit that are made independent adopt a different encryption method from other encryption circuits and decryption circuits. It doesn't matter.
[0143]
Next, as described above (Method 2), the DVD 101 has n E corresponding to all i = 1 to n._MKi(S_K), And one M in the decoding unit 114a where j is 1 to n_kjThe operation of this embodiment will be described with reference to the flowcharts of FIGS.
[0144]
In step S11, a first session key S recorded on the DVD 101 by a DVD drive device (not shown)._KFirst session key E encrypted by itself_Sk(S_K) And read into the encryption unit 107. At this time, the demodulation / error correction circuit 117 performs demodulation and error correction in the data.
[0145]
In step S12, the master key M recorded on the DVD 101 by a DVD drive device (not shown)._kiN first session keys E encrypted using_Mki(S_K) (I = 1 to n) is read and taken into the encryption unit 107. At this time, the demodulation / error correction circuit 117 performs demodulation and error correction in the data.
[0146]
On the other hand, in step S13, in the decryption unit 114a, the session key generation circuit 111 receives a random number, for example, time information from a clock (not shown) as an input, and receives the second session key S._K′ Is generated. Then, in the decryption circuit 112, the generated second session key S_K′, Master key M_kj(Where j is a predetermined one of 1 to n)_Mkj(S_K′) Is generated and sent to the encryption unit 107 through the CPU BUS 110.
[0147]
As a timing for generating the random number (for example, a timing for inputting time information), for example, a timing at which a signal indicating that the DVD 101 is mounted on the DVD drive apparatus is asserted can be used.
[0148]
In step S 14, the encryption unit 107 receives the D received through the CPU BUS 110 in the encryption circuit 104._Mkj(S_K′), Master key M_kj(Where j is a predetermined one of 1 to n) is used for encryption. That is,
E_Mkj(D_Mkj(S_K′)) = S_K′
The second session key S generated by the session key generation circuit 111 in the decryption unit 114a_K'Can be obtained.
[0149]
Here, the second session key S generated by the session key generation circuit 111_K'Is not understood even if it is stolen on the CPU BUS110.
[0150]
Next, in step S15, the cryptographic unit 107 uses the second session key S obtained as described above._K′, The encrypted first session key E recorded on the DVD 101_Sk(S_K) And E_{SK ′}(E_Sk(S_K)) And sends it to the decryption unit 114a through the CPU BUS110.
[0151]
Similarly, in step S16, the cryptographic unit 107 uses the second session key S obtained as described above._K′, The encrypted n first session keys E recorded on the DVD 101_Mki(S_K) And E_{SK ′}(E_Mki(S_K)) And sends it to the decryption unit 114a through the CPU BUS110.
[0152]
Next, in step S17, in the decryption unit 114a, the decryption circuit 112 receives the E received through the CPU BUS110._{SK ′}(E_Sk(S_K)) For the second session key S_KDecrypt using '
D_{SK ′}(E_{SK ′}(E_Sk(S_K))) = E_Sk(S_K)
Get.
[0153]
Similarly, in step S18, the decryption unit 114a causes the decryption circuit 112 to receive the n E's received through the CPU BUS 110._{SK ′}(E_Mki(S_K)) For the second session key S_KDecode each using ′,
D_{SK ′}(E_{SK ′}(E_Mki(S_K))) = E_Mki(S_K)
Get.
[0154]
Here, n E recorded on the DVD 101_Mki(S_K) (I = 1 to n) for each of the master keys M used in generating it_kiIs unknown and the master key M provided in the decryption unit 114a_kjI don't know which one corresponds to. Therefore, in step S19, the first session key S is used by using the key determination circuit 120 as shown below._KAsk for.
[0155]
First, the principle of the key determination process will be described.
[0156]
First, master key M_kjAnd all E_Mki(S_K) (I = 1 to n)
S_kij= D_Mkj(E_Mki(S_K)) (I = 1 to n)
Is obtained. Where S_kijAny one of (i = 1 to n) is the first session key S_KIt is.
[0157]
Next, the above E_Sk(S_K) To generate the generated S_kijAny of (i = 1 to n) is the first session key S_KFind out if it is.
[0158]
So E_Sk(S_K) For all first session key candidates S_kijWhen decoding with (i = 1 to n) respectively,
S_k′ ′ (I, j) = D_Skij(E_Sk(S_K))
Is obtained.
[0159]
Where E_Mki(S_K) Used to create the master key M_kiSame master key M_kjIs used in the decoding unit, i.e., i = j, S_k′ ′ (I, j) = S_kij= S_KIt becomes.
[0160]
Therefore, each S_kijFor (i = 1 to n), S_k′ ′ (I, j) = S_kij  By examining whether (j = 1 to n) holds, S_k′ ′ (I, j) = S_kijS satisfying (j = 1 to n)_kijTo the first session key S_KCan be obtained as This S_kijThe master key used this time corresponds to i which gives.
[0161]
For example, in the key determination circuit 120 of FIG. 6, the decryption circuit 112 first sets i = 1 and sets E = 1._Mki(S_K), Master key M_kjDecrypt with
S_kij= D_Mkj(E_Mki(S_K))
Get.
[0162]
Next, the decryption circuit 112 causes E_Sk(S_K) S_kijDecrypt with
S_k′ ′ = D_Skij(E_Sk(S_K))
Get.
[0163]
Next, the comparison circuit 121 performs the above S._k'And = S_kijIf they match, the gate circuit 122 is controlled and held._kij(Fig. 6 (a)) or S_k′ ”(FIG. 6B) is changed to the first session key S._KOutput as.
[0164]
If they do not match, the above-described i is incremented by 1 and the same operation is performed as the first session key S._KRepeat until is obtained.
[0165]
In this way, the first session key S_KAfter obtaining the first session key S in steps S20 to S22 as described above._KThe encrypted image data E_SKImage data Data is extracted from (Data).
[0166]
As described above, the image data Data is decoded by the MPEG decoder circuit 115, converted into an analog signal by the D / A conversion circuit 116, and sent to a video device such as a television (not shown) for reproduction. The
[0167]
In the case of Method 2, any of Step S11, Step S12, Steps S13 and S14 may be executed first.
[0168]
Further, any of steps S15 and S17 and steps S16 and S18 may be executed first.
[0169]
Further, the steps S12, S16, S18, and S19 may be performed batchwise for n (encrypted) master keys recorded on the DVD, but batches for every predetermined number of master keys. It may be performed manually or sequentially for each master key.
[0170]
In addition, when performing sequentially for every third master key, the second session key S_K'May be generated for each master key.
[0171]
In addition, for execution of step S20 and step S21, one E_SKA method of sequentially performing in units of (Data), or a predetermined number of E in step S20_SK(Data) is read, temporarily stored in a buffer or the like, and then in step S21, E_SKA method of decoding (Data) or a method of performing step S20 and step S21 in a pipeline process is conceivable.
[0172]
Also, the image data E is sent from the decoding unit 114 to the MPEG decoder circuit 115._SKWhen transferring (Data), it may be transferred in units of one Data, or may be transferred in units of a predetermined number of Data.
[0173]
As described above, according to the present embodiment, as in the first embodiment, even if data flowing through the CPU BUS is stored, it cannot be reproduced or used.
[0174]
As a result, illegal copying of media can be prevented by illegal copying and copyright can be protected.
[0175]
In addition, according to the present embodiment, the first session key encrypted using a plurality of master keys and the first session key encrypted by the first session key itself are stored in the recording medium. There is an advantage that the master key built in the decryption unit can be assigned to a predetermined unit, for example, each manufacturer of the unit.
[0176]
Also in this embodiment, the circuit used for encryption and decryption can be designed separately from the core part of the playback part of a digital recording / playback device such as a DVD, as can be seen from FIG. Even so, it is only necessary to exchange the decryption unit 114b (or the encryption unit 107 and the decryption unit 114b).
[0177]
In the present embodiment, the encryption unit 107 has one encryption circuit, but two encryption circuits may be provided. The decoding unit 114a has one decoding circuit, but may be provided as two, three, four, or five decoding circuits. In these cases, it is preferable to make the corresponding encryption circuit and decryption circuit independent or shared in a set.
[0178]
Also, when the corresponding encryption circuit and decryption circuit are made independent as a set, the corresponding encryption circuit and decryption circuit that are made independent adopt a different encryption method from other encryption circuits and decryption circuits. It doesn't matter.
[0179]
Next, as described above (Method 3), the DVD 101 has n E corresponding to all i = 1 to n._MKi(S_K), And in the decoding unit 114a, m M << n types of 1 to n_kjThe case where it comprises is demonstrated.
[0180]
Since the basic configuration, operation, and effect of this method 3 are the same as those of the above method 2, only the differences will be described here.
[0181]
In the above method 2, one master key M predetermined in the decryption unit 114a._kj(In this method 3, m (≧ 2) master keys M determined in advance in the decryption unit 114a._kjPrepare. And m master keys M_kjThe order used for the above-described key determination in the decryption unit 114b is determined for (j is any one of 1 to n).
[0182]
Initially, the DVD 101 has n E corresponding to all i = 1 to n._MKi(S_K) Is recorded, the first session key S can be obtained by using the master key having the highest usage order in the decryption unit 114b._KIn this case, the operation is the same as that of the method 2 described above.
[0183]
Next, in method 3, when any master key is broken, the master key is disabled, and thereafter, the E corresponding to the master key disabled for the DVD 101 is used._MKi(S_K) Is not recorded.
[0184]
Here, if the master key that has become unusable is not the master key with the highest usage order, the first session key S_KIn this case, the operation is the same as that of the method 2 described above.
[0185]
On the other hand, when the master key with the first usage order becomes unusable, the DVD 101 has an E corresponding to the master key._MKi(S_K) Is not recorded, so even if the master key with the highest usage order is used, the first session key S in step S19 is used._KCan't get. In such a case, if the master key is not unusable by performing the same operation as the method 2 using the master key with the second use order in the decryption unit 114a, the first session Key S_KCan be obtained.
[0186]
In the following, when the master key with the r usage rank becomes unusable, but there is a master key with the usage rank of r + 1 or higher that is not unusable, similarly, the first session key S_KCan be obtained.
[0187]
In this way, the present decryption unit 114a can be used until all m (≧ 2) master keys determined in the decryption unit 114a become unusable.
[0188]
The operation of (Method 5) described above is the same as that of (Method 3).
[0189]
In the above (Method 4), since information corresponding to all master keys is not stored in the DVD 101, information corresponding to the master key selected in the decryption unit is not recorded on the DVD 101. Cannot be decrypted in the same manner as in the case of the above-described unusable, and the master key of the next usage order is selected and decryption is attempted. Therefore, the operation of (Method 4) is the same as that of (Method 3).
[0190]
By the way, in the present embodiment, in order to encrypt and securely transfer information on the CPU BUS 110, the second session key S_K'Was used. This second session key S_K'Is generated in the decryption unit 114a and transmitted to the encryption unit 107 by the procedure using the master key. At this time, in the present embodiment, it is assumed that one predetermined master key is registered in the encryption unit 107.
[0191]
Instead, a plurality of master keys are registered in the encryption unit 107, and the second session key S is used by using the procedure such as (Method 1) to (Method 5) described above using key determination._K'May be transmitted from the decryption unit 114a to the encryption unit 107.
[0192]
For example, when the same master key registered in the decryption unit 114a is also registered in the encryption unit 107, the above (Method 5) is performed.
[0193]
When a plurality of master keys registered in the decryption unit 114a are registered in the encryption unit 107, the above (Method 3) is performed.
[0194]
Even when one master key is registered in the encryption unit 107, the procedure of (Method 2) described above can be used.
[0195]
However, in these cases, the procedure of (Method 1) to (Method 5) is a procedure in which encryption and decryption are interchanged. That is, D from the decryption unit 114a to the encryption unit 107_MKi(S_K) And D_SK(S_K) And will be transferred.
[0196]
The second session key S_KAs a configuration for safely transmitting 'to the encryption unit 107 from the decryption unit 114a via the CPU BUS 110, various configurations other than the configuration using the master key can be applied. For example, the technique disclosed in “Nikkei Electronics No. 676 pp. 13-14 1996.11.18” can be applied. In this case, registration of the master key in the encryption unit 107 is not necessary.
[0197]
(Third embodiment)
Next, a third embodiment will be described.
[0198]
This embodiment is, for example, a single DVD player.
[0199]
FIG. 9 is a block diagram showing a configuration of a system according to the second embodiment of the present invention. An example of the operation of this embodiment is shown in the flowchart of FIG.
[0200]
In the present embodiment, the part related to the operation of transferring the encryption key using the second session key between the encryption unit and the decryption unit is deleted from the configuration of the second embodiment.
[0201]
That is, as shown in FIG. 9, the system according to the present embodiment includes a DVD drive device (not shown) for reading data from the DVD 101, and a decoding unit 114b.
[0202]
The decryption unit 114b includes a decryption circuit 112, a key determination circuit 120, a demodulation / error correction circuit 117, and a demodulation / error correction circuit 118. In the present embodiment, it is assumed that the decoding unit 114 includes an MPEG decoder circuit 115 and a conversion circuit 116 that converts decoded image data from digital to analog.
[0203]
Here, the key determination circuit 120 includes a decryption circuit 112, a comparison circuit 121, and a gate circuit 122, as shown in one configuration example of FIG.
[0204]
9 and 6, the decryption unit 114b includes three decryption circuits 112 including the two decryption circuits 112 in the key determination circuit 120. Assume that there are two decoding circuits. Note that the demodulation / error correction circuit 117 and the demodulation / error correction circuit 118 may not be provided in the encryption unit 107 but may be provided on the side of the preceding unit or the like.
[0205]
It is assumed that the decryption unit 114b is formed as one independent IC chip.
[0206]
Also, a master key to be described later is registered (built in) in the decryption unit 114b. It is assumed that the master key is recorded in a secret area inside the chip so that the user cannot intentionally take it out so that the user cannot obtain it from the outside.
[0207]
In the present embodiment, the first session key is S_K, Set the second session key to S_K', The i-th one of the n types of master keys is M_ki(Where i = 1 to n), image data (however, a group of encrypted data) is represented by Data. These are all plaintext.
[0208]
In FIG. 1, 102-1 is the first session key S._KMaster key M_kiE generated by encryption using_MKi(S_K), 102-2 is the first session key S_KTo the first session key S_KE generated by self-encryption_Sk(S_K), 103 designates the image data Data as the first session key S._KE generated by encryption using_SK(Data), 105 is the master key M_kj113 is the first session key S_KRespectively.
[0209]
Here, as in the second embodiment, the first session key S recorded on the DVD 101 is used._KMaster key M_kiE generated by encryption using_MKi(S_K) And the master key M held in the decryption unit 114b_kjFor the setting of the number of types, for example, several methods are conceivable as shown below.
[0210]
(Method 1) DVD 101 has one E in which i is any one of 1 to n._MKi(S_K) And n M corresponding to all j = 1 to n in the decoding unit 114b._kjIs provided.
[0211]
(Method 2) The DVD 101 has n E corresponding to all of i = 1 to n._MKi(S_K), And one M in the decoding unit 114b where j is 1 to n_kjIs provided.
[0212]
(Method 3) The DVD 101 has n E corresponding to all i = 1 to n._MKi(S_K), And in the decoding unit 114b, m pieces of M, where j is m (2 <m <n) of 1 to n_kjIs provided.
[0213]
(Method 4) In the DVD 101, m master keys E in which i is m (2 <m <n) types preselected from 1 to n._MKi(S_K) And n master keys M corresponding to all of j = 1 to n are stored in the decryption unit 114b._kjIs provided.
[0214]
(Method 5) The DVD 101 has n master keys E corresponding to all i = 1 to n._MKi(S_K) And n master keys M corresponding to all of j = 1 to n are stored in the decryption unit 114b._kjIs provided.
[0215]
As shown in FIG. 3, on the DVD 101, the first session key S_KMaster key M_kiOne (in the case of (Method 1) described above) or a plurality of (in the case of (Method 2) to (Method 5) above) generated by encryption using_MKi(S_K) Stores the image data Data in the first session key S in the key recording area (lead-in area) in the innermost periphery._KE generated by encryption using_SK(Data) is recorded in the data recording area (data area).
[0216]
Next, the operation of this embodiment will be described with reference to the flowchart of FIG. The operation of the present embodiment is obtained by deleting a part related to the operation of passing the encryption key between the encryption unit and the decryption unit using the second session key from the operation of the second embodiment. is there.
[0217]
That is, in step S31, the first session key S recorded on the DVD 101 by a DVD drive device (not shown)._KFirst session key E encrypted by itself_Sk(S_K) And read into the decoding unit 114b. At this time, the demodulation / error correction circuit 117 performs demodulation and error correction in the data.
[0218]
In step S32, the master key M recorded on the DVD 101 by a DVD drive device (not shown)._kiThe first session key E encrypted using_Mki(S_K) And read into the decoding unit 114b. At this time, the demodulation / error correction circuit 117 performs demodulation and error correction in the data.
[0219]
Next, in step S33, the key determination circuit 120 is used to set the first session key S._KAsk for.
[0220]
The above first session key S_KThe operation for obtaining is different depending on (Method 1), (Method 2), and (Method 3 to Method 5), but in any case, it is the same as that already described in the second embodiment. Description of is omitted.
[0221]
First session key S_KAfter obtaining the first session key S in steps S34 to S36 as described above._KThe encrypted image data E_SKImage data Data is extracted from (Data). The operations in steps S34 to S36 are the same as those in steps S20 to S22 (that is, in the first embodiment) already described in the second embodiment, except that image data Data is not transferred between the units via the CPU BUS. This is the same as steps S6 to S8) already described.
[0222]
As described above, the image data Data is decoded by the MPEG decoder circuit 115, converted into an analog signal by the D / A conversion circuit 116, and sent to a video device such as a television (not shown) for reproduction. The
[0223]
In the case of this method 3, either step S31 or step S32 may be executed first.
[0224]
In the case of (Method 2) and (Method 3 to 5), the steps S32 and S33 are performed for n (in the case of methods 2, 3, and 5) or m (in the case of method 4) recorded on the DVD. The (encrypted) master keys may be performed batchwise, but may be performed batchwise for each predetermined number of master keys, or may be performed sequentially for each master key.
[0225]
Further, for the execution of step S34 and step S35, one E_SKA method of sequentially performing in units of (Data), or a predetermined number of E in step S20_SK(Data) is read, temporarily stored in a buffer or the like, and then in step S21, E_SKA method of decoding (Data) or a method of performing step S20 and step S21 in a pipeline process is conceivable.
[0226]
Also, the image data E is sent from the decoding unit 114 to the MPEG decoder circuit 115._SKWhen transferring (Data), it may be transferred in units of one Data, or may be transferred in units of a predetermined number of Data.
[0227]
According to the present embodiment, illegal copying of media can be prevented by illegal copying, and copyright can be protected.
[0228]
Further, according to the present embodiment, it is possible to appropriately select and use a master key within a predetermined range when recording on a DVD or the like. Alternatively, there is an advantage that a master key that can be used for each predetermined unit such as a DVD player manufacturer or a DVD production / sales company can be assigned and used.
[0229]
In this embodiment, the circuit used for encryption and decryption can be designed separately from the core of the playback portion of a digital recording / playback device such as a DVD as can be seen from FIG. Even so, it is only necessary to replace the decoding unit 114b.
[0230]
In the present embodiment, the decoding unit 114b has one decoding circuit, but may be provided as two or three decoding circuits. In these cases, it is preferable to make the corresponding encryption circuit and decryption circuit independent or shared in a set.
[0231]
In addition, when the corresponding encryption circuit and decryption circuit are made independent as a set, the corresponding encryption circuit and decryption circuit that are made independent adopt a different encryption method from other encryption circuits and decryption circuits. It doesn't matter.
[0232]
The first embodiment, the second embodiment (more specifically, three types of configurations), and the third embodiment (more specifically, three types of configurations) have been described above, but the present invention is limited to these. However, various modifications can be made.
[0233]
In each embodiment, the information recording medium is described as a DVD. However, the present invention can also be applied to other recording media such as a CD-ROM.
[0234]
In each embodiment, image data has been described as an example of information to be decoded. However, the present invention can also be applied to a reproducing apparatus for information in other forms such as voice, text, and a program.
[0235]
In each embodiment, the data Data is image data, but the data Data is the key information S._ktA configuration is also conceivable. That is, E is recorded on a recording medium such as a DVD._SKE instead of (Data)_SK(S_kt) And E_Skt(Data) is recorded, and the decryption units 114, 114a, and 114b first perform S by the procedure shown in each embodiment._ktGet this S_ktE_Skt(Data) can also be decrypted to obtain the actual content. Such key hierarchization can be performed over an arbitrary hierarchy.
[0236]
In each embodiment, the case where the information to be decoded is compressed according to the MPEG2 standard has been described as an example. However, the present invention is not limited to this, and the data may be compressed or encoded according to other standards. I do not care. In this case, another corresponding decoder circuit is provided instead of the MPEG decoder circuit 115. Further, it may not be encoded. In this case, the MPEG decoder circuit 115 is deleted.
[0237]
In addition, a plurality of types of decoding circuits are provided so that any of the data compressed by various methods (or data that does not need to be decoded) can be output, and these are used by switching appropriately (or not using them). It is also possible to configure. In this case, for example, a method of reading an identifier indicating a decoding to be used from a recording medium such as a DVD and selecting an appropriate decoding circuit or the like according to the identifier is conceivable.
[0238]
The configuration of the key determination circuit 120 of FIG. 6 shown in the second embodiment and the third embodiment is an example, and various other configurations can be considered.
[0239]
Further, E as key determination information_SK(S_KIn addition to this, various other configurations can be considered. For example, as information used for key determination, D_SK(S_K), And the key determination circuit 120 reads E read from a recording medium such as a DVD._Mki(S_K) Stored master key M_kjDecrypt with S_kij= D_Mkj(E_Mki(S_K))_kijS_kijDecrypt yourself and S_k′ ′ ′ = D_Skij(S_kij), Then this S_k'And D read from a recording medium such as a DVD_SK(S_K) And if there is a match, the first session key S_K= S_kijIs determined to be correct and output.
[0240]
Another example of the key determination information is one that has been encrypted or decrypted twice or more, for example, E_SK(E_SK(S_K)), D_SK(D_SK(S_K)), Or each E_Mki(S_K) Corresponding to E_Mki(E_Mki(S_KVarious things such as those provided with)) are conceivable.
[0241]
In each embodiment, the key obtained by decryption using the procedure shown in (Method 1) to (Method 5) based on the key determination information is that the first session key is correct. But all E in the order of i on a recording medium such as a DVD_Mki(S_K) And i and M are stored in the decoding unit._kiAre registered in association with each other, the key determination information, the key determination procedure, and the configuration therefor can be omitted. M for some i_kiIs no longer usable, E is recorded on a recording medium such as a DVD._Mki(S_KIt is desirable to store information indicating invalidity instead of ().
[0242]
Next, with reference to FIG. 11, a DVD-ROM is taken as an example, and a disc manufacturer (assuming a manufacturer that produces DVDs of works such as movies and music) and a player manufacturer using the third embodiment described above. (A single DVD player manufacturer) and a key management method by a key management organization that manages a master key will be described. In addition to content, Data may be key information as described above (Data is key information S)._ktIf this key information S_kt(Description of encryption, decryption, and the like using) is omitted). In FIG. 11, a computer used for processing or the like is omitted.
[0243]
FIG. 12 is a diagram for explaining a system for encryption. The encryption circuits 301, 312, and 303 in FIG. 12 may be mounted on the same device (computer or the like) or on a different device (computer or the like). In the latter case, the device Information is exchanged between them. The encryption circuits 301, 312, and 303 can be configured by hardware or software.
[0244]
Here, the above-mentioned (Method 3) DVD has n master keys E corresponding to all i = 1 to n._MKi(S_K), And in the DVD player (decoding unit 114b), m master keys M having j (m <2 <m <n) types selected in advance from 1 to n._kjThe case where it comprises is demonstrated. Note that the master key M is available for DVD player manufacturers._kjShall be assigned exclusively. Here, n = 100 and m = 10.
[0245]
Further, here, as the key determination information, the DVD contains E._SK(S_K) Is used (the portion 302 in FIG. 12 indicates the key determination information as E_SK(S_K).
[0246]
First, in the key management organization 200, the master key M_Ki(I = 1 to 100) are stored. It is desirable to set an extra number for the master key in order to make a new entry for a player maker or for a backup in the event of a break.
[0247]
In the key management organization 200, each player maker 201-203 has an exclusive master key M._Ki(I = 1 to 100) is assigned. For example, as shown in FIG._Ki(I = 10-19) to the player maker B with the master key M_Ki(I = 20 to 29) to the master key M_Ki(I = 30 to 39) is assigned. The assigned master key is sent from the key management organization 200 (computer, etc.) to each player maker (computer, etc.) via a communication medium or a recording medium. At that time, it is desirable to securely deliver the data using encryption communication or the like.
[0248]
Each player maker individually manages a master key assigned from the key management organization 200. Each player maker uses the assigned master key to manufacture and sell a DVD player having the configuration shown in the third embodiment.
[0249]
On the other hand, here, it is assumed that the master key plain data is not passed from the key management organization 200 to the disk makers 221 to 223.
[0250]
First, each disk manufacturer (referred to as “a”) uses its own first session key S._k(E.g., determined for each disk) and the first session key S_kTo the key management organization 200. The key management organization 200 receives the received first session key S_kTo all master keys M_Ki(I = 1 to 100)_Mki(S_K), (I = 1 to 100) is obtained (using the encryption circuit 301 in FIG. 12). Then, the key management organization 200 is E_Mki(S_K), (I = 1 to 100) are transferred to the disk manufacturer a.
[0251]
In the same manner as described above, information is exchanged between the key management organization 200 (computer, etc.) and the disk manufacturer (computer, etc.) using the assigned master key using a communication medium or a recording medium, etc. It is desirable to do it safely.
[0252]
In disk manufacturer a, E_Mki(S_K), (I = 1-100) and E_SK(S_K) And E_SK(Data)) is recorded on the DVD 231 and sold. S_KS yourself_KE to encrypt_SK(S_KAre obtained on the disk manufacturer side and on the key management organization 200 side as in the case of encryption with the master key (using the encryption circuit 312 in FIG. 12). Further, at least the content is encrypted by the disc manufacturer (using the encryption circuit 303 in FIG. 12).
[0253]
In the disk manufacturer a, for example, S_KReceived E_Mki(S_K) And E for key determination information_SK(S_K) And E_SK(Data) (or Data) is managed.
[0254]
The same applies to other disk manufacturers.
[0255]
If it is discovered that the master key has been broken, DVDs will be produced without using the broken master key. For example, when the master key of i = 19 is broken, the DVD contains E corresponding to 99 of i = 1 to 18, 20 to 100._Mki(S_K) Is recorded.
[0256]
Further, when it is discovered that the master key has been broken, it is desirable that the player manufacturer to which the broken master key is assigned thereafter manufactures and sells DVD players except for this. . For example, when the master key of i = 19 is broken, the player manufacturer A manufactures and sells a DVD player using the master key of i = 10-18.
[0257]
Further, a DVD player having an i = 19 master key already sold may be used as it is. However, the master key of i = 19 may not be provided by unit replacement or the like.
[0258]
Accordingly, it is possible to manage the master key safely and effectively, distribute the risk of unauthorized master key decryption, and allow the system to function safely and effectively even after master key decryption.
[0259]
The present invention is not limited to the embodiment described above, and can be implemented with various modifications within the technical scope thereof.
[0260]
【The invention's effect】
  According to the present invention, only a legitimate player having at least one of a plurality of master keys can obtain a session key, and thus can obtain plain data of content encrypted with the master key. As a result, illegal copying of media can be prevented by illegal copying and copyright can be protected.
[Brief description of the drawings]
FIG. 1 is a block diagram showing the configuration of a system according to a first embodiment of the present invention.
FIG. 2 is a flowchart showing the operation of the embodiment.
FIG. 3 is a diagram showing an example of a format for storing an encrypted key and encrypted data in a recording medium.
FIG. 4 is a diagram for explaining a case where data is saved from a CPU BUS
FIG. 5 is a block diagram showing a configuration of a system according to a second embodiment of the present invention.
FIG. 6 is a diagram illustrating an example of an internal configuration of a key determination unit
FIG. 7 is a flowchart showing the operation of the embodiment.
FIG. 8 is a flowchart showing the operation of the embodiment.
FIG. 9 is a block diagram showing a configuration of a system according to a third embodiment of the present invention.
FIG. 10 is a flowchart showing the operation of the embodiment.
FIG. 11 is a diagram for explaining a key management method;
FIG. 12 is a diagram for explaining encryption;
[Explanation of symbols]
101 ... DVD
102, 202 ... the first session key encrypted using the master key
103, 203 ... Image data encrypted using the first session key
104 ... Encryption circuit
105 ... Master key
106: Second session key
107 ... Encryption unit
108 ... the second session key decrypted using the master key
109 ... The first session key encrypted using the second session key and encrypted using the master key
110 ... CPU BUS
111 ... Session key generation circuit
112: Decoding circuit
113 ... 1st session key
114, 114a, 114b ... decoding unit
115... MPEG decoder circuit
116: Digital / analog conversion circuit
209 ... A line for copying from the read output of the DVD to another medium
210 ... Line for copying from CPU BUS to another medium
211 ... Digital storage medium
200: Key management organization
201-203 ... Player maker
221 to 223 ... Disc manufacturer
231-233 ... DVD
301, 312, 303 ... Encryption circuit

Claims (8)

A key processing method in a disk manufacturer side processing apparatus provided on a disk manufacturer side that supplies a disk on which encrypted content is recorded, and comprising a session key generation means, a delivery means, an encryption means, and a recording means. There,
Generating a session key by the session key generating means;
The generated session key is supplied to the key management organization-side processing apparatus previously stored in the storage unit by the delivery unit via the communication medium and stored in the storage unit. Key information created by the management organization side processing device, each of which is obtained by encrypting the session key with the plurality of master keys, is received from the key management organization side processing device via the communication medium by the delivery means, and the encryption Encrypting the content with the session key by the encryption means;
And a step of recording the content encrypted with the session key and the key information received from the key management organization side processing device on a disk to be supplied by the recording means. Method. Instead of recording the content encrypted with the session key on the disc, the disk manufacturer side processing device stores the other key encrypted with the session key and the content encrypted with the other key. The key processing method according to claim 1 , wherein the key processing method is recorded on a disc. 3. The key processing method according to claim 1, wherein the disk manufacturer-side processing apparatus records a session key created by itself and encrypted with the session key itself onto the disk. The disk manufacturer side processing device supplies the session key to the key management organization side processing device, receives a session key encrypted by the session key itself created by the key management organization side processing device, 3. The key processing method according to claim 1, wherein a session key encrypted by the key itself is also recorded on the disc. A disk manufacturer side processing device provided on the disk manufacturer side that supplies a disk on which encrypted content is recorded,
Means for generating a session key;
The generated session key is supplied via a communication medium to a key management organization side processing apparatus that is provided on the key management organization side and stores a plurality of master keys in a storage unit in advance. A delivery means for receiving key information created by a device, wherein the session key is encrypted with each of the plurality of master keys;
Means for encrypting content with the session key;
A disk manufacturer side processing device comprising: a recording unit for recording the content encrypted with the session key and the key information received from the key management organization side processing device on a disk to be supplied. . Instead of recording the content encrypted with the session key on the disc, the recording unit records the other key encrypted with the session key and the content encrypted with the other key on the disc. 6. The disk manufacturer side processing apparatus according to claim 5 , wherein 7. The disk manufacturer side processing apparatus according to claim 5 , wherein the recording means also records a session key created by itself and encrypted with the session key itself onto the disk. The recording means supplies the session key to the key management organization side processing device, receives a session key encrypted by the session key itself created by the key management organization side processing device, and uses the session key itself. 7. The disk manufacturer side processing apparatus according to claim 5, wherein an encrypted session key is also recorded on the disk.

Images